{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"chuanhuchatgpt","cve_ids":["CVE-2024-7962"],"ecosystem":"PyPI","epss":0.00792,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGKYCDM1MY6P4S4KMSGSVX","modified_at":"2024-10-31T19:44:10.888628Z","published_at":"2024-10-29T13:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-112","https://huntr.com/bounties/83f0a8e1-490c-49e7-b334-02125ee0f1b1","https://github.com/gaizhenbiao/chuanhuchatgpt/commit/2836fd1db3efcd5ede63c0e7fbbdf677730dbb51"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2024-112","url":"https://osv.dev/vulnerability/PYSEC-2024-112"}],"summary":"An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. An attacker can read any file that matches"}