{"action":"Upgrade inventree to 0.8.3 or later.","affected":[{"fixed":"0.8.3","introduced":"0"}],"component":"inventree","cve_ids":["CVE-2022-3355"],"ecosystem":"PyPI","epss":0.00873,"exploited":false,"fixed_versions":["0.8.3"],"ghsa_id":"GHSA-62g7-fpv9-v95f","id":"tcs_01M5KHDS7JSGSWBGAX6E7YRYGC","modified_at":"2026-07-07T11:46:03.585302337Z","published_at":"2026-07-07T10:17:22.328294Z","references":["https://osv.dev/vulnerability/PYSEC-2026-823","https://nvd.nist.gov/vuln/detail/CVE-2022-3355","https://github.com/inventree/inventree/commit/5a08ef908dd5344b4433436a4679d122f7f99e41","https://github.com/inventree/InvenTree/releases/tag/0.8.3","https://github.com/inventree/inventree","https://huntr.dev/bounties/4b7fb92c-f06b-4bbf-82dc-9f013b30b6a6","https://pypi.org/project/inventree","https://github.com/advisories/GHSA-62g7-fpv9-v95f"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-823","url":"https://osv.dev/vulnerability/PYSEC-2026-823"}],"summary":"Inventree vulnerable to Stored Cross-site Scripting"}