{"action":"Upgrade werkzeug to 2.3.8 or later.","affected":[{"fixed":"2.3.8","introduced":"0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"werkzeug","cve_ids":["CVE-2023-46136"],"ecosystem":"PyPI","epss":0.01288,"exploited":false,"fixed_versions":["2.3.8","3.0.1"],"ghsa_id":"GHSA-hrfv-mqp8-q5rw","id":"tcs_01M5KGJZ1CDV8HWEY62YCFSVZR","modified_at":"2023-11-08T18:38:34.170214Z","published_at":"2023-10-25T18:17:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-221","https://github.com/pallets/werkzeug/commit/f3c803b3ade485a45f12b6d6617595350c0f03e2","https://github.com/pallets/werkzeug/security/advisories/GHSA-hrfv-mqp8-q5rw"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2023-221","url":"https://osv.dev/vulnerability/PYSEC-2023-221"}],"summary":"Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are ap"}