{"action":"Upgrade github.com/ncarlier/webhookd to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"github.com/ncarlier/webhookd","cve_ids":["CVE-2026-59157"],"ecosystem":"Go","epss":0.00596,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-v25g-mvwr-f5fp","id":"tcs_01M5KGTS1E1T3WY3MPNXE3FDFW","modified_at":"2026-09-17T17:30:11.275252224Z","published_at":"2026-09-16T16:56:22Z","references":["https://osv.dev/vulnerability/GO-2026-6451","https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp","https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6451","url":"https://osv.dev/vulnerability/GO-2026-6451"}],"summary":"webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd"}