{"action":"Upgrade org.xwiki.commons:xwiki-commons-velocity to the fixed version for your line (see fixed_versions).","affected":[{"fixed":"14.10.19","introduced":"3.0.1"},{"fixed":"15.5.4","introduced":"15.0-rc-1"},{"fixed":"15.9-rc-1","introduced":"15.6-rc-1"}],"component":"org.xwiki.commons:xwiki-commons-velocity","cve_ids":["CVE-2024-31996"],"ecosystem":"Maven","epss":0.02104,"exploited":false,"fixed_versions":["14.10.19","15.5.4","15.9-rc-1"],"ghsa_id":"GHSA-hf43-47q4-fhq5","id":"tcs_01M5N90D0X8WZB9SSY5XE6Q3E5","modified_at":"2026-09-10T03:50:11.360258064Z","published_at":"2024-04-10T17:16:37Z","references":["https://osv.dev/vulnerability/GHSA-hf43-47q4-fhq5","https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5","https://nvd.nist.gov/vuln/detail/CVE-2024-31996","https://github.com/xwiki/xwiki-commons/commit/b0805160ec7b01ee12417e79cb384e60ae4817aa","https://github.com/xwiki/xwiki-commons/commit/b94142e2a66ec32e89eacab67c3da8d91f5ef93a","https://github.com/xwiki/xwiki-commons/commit/ed7ff515a2436a1c6dcbd0c6ca0c41e434d58915","https://github.com/xwiki/xwiki-commons","https://jira.xwiki.org/browse/XCOMMONS-2828","https://jira.xwiki.org/browse/XWIKI-21438"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-hf43-47q4-fhq5","url":"https://osv.dev/vulnerability/GHSA-hf43-47q4-fhq5"}],"summary":"XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution"}