{"action":"Upgrade org.scala-sbt:io_2.13 to 1.9.7 or later.","affected":[{"fixed":"1.9.7","introduced":"1.0.0"}],"component":"org.scala-sbt:io_2.13","cve_ids":["CVE-2023-46122"],"ecosystem":"Maven","epss":0.00369,"exploited":false,"fixed_versions":["1.9.7"],"ghsa_id":"GHSA-h9mw-grgx-2fhf","id":"tcs_01M5N90874X3VZWNJBWZ3DXAYT","modified_at":"2024-02-16T08:15:38.939403Z","published_at":"2023-10-24T01:51:04Z","references":["https://osv.dev/vulnerability/GHSA-h9mw-grgx-2fhf","https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf","https://nvd.nist.gov/vuln/detail/CVE-2023-46122","https://github.com/sbt/io/issues/358","https://github.com/sbt/io/pull/360","https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a","https://github.com/sbt/sbt"],"severity":{"label":"low","score":3.9},"sources":[{"source":"osv","source_id":"GHSA-h9mw-grgx-2fhf#Maven/org.scala-sbt:io_2.13","url":"https://osv.dev/vulnerability/GHSA-h9mw-grgx-2fhf"}],"summary":"sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)"}