{"action":"Upgrade scancodeio to 32.5.2 or later.","affected":[{"fixed":"32.5.2","introduced":"0"}],"component":"scancodeio","cve_ids":["CVE-2023-40024"],"ecosystem":"PyPI","epss":0.00506,"exploited":false,"fixed_versions":["32.5.2"],"ghsa_id":"GHSA-6xcx-gx7r-rccj","id":"tcs_01M5KGWCG3Y1MF2BA6Z4RX5YGV","modified_at":"2026-07-07T17:47:51.792846203Z","published_at":"2026-07-07T11:45:22.677621Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1905","https://github.com/nexB/scancode.io/security/advisories/GHSA-6xcx-gx7r-rccj","https://nvd.nist.gov/vuln/detail/CVE-2023-40024","https://github.com/nexB/scancode.io","https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc4838214098a11/CHANGELOG.rst#v3252-2023-08-14","https://github.com/nexB/scancode.io/releases/tag/v32.5.2","https://pypi.org/project/scancodeio","https://github.com/advisories/GHSA-6xcx-gx7r-rccj"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1905","url":"https://osv.dev/vulnerability/PYSEC-2026-1905"}],"summary":"Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint"}