{"action":"Upgrade org.openrefine.dependencies:butterfly to 1.2.6 or later.","affected":[{"fixed":"1.2.6","introduced":"0"}],"component":"org.openrefine.dependencies:butterfly","cve_ids":[],"ecosystem":"Maven","exploited":false,"fixed_versions":["1.2.6"],"ghsa_id":"GHSA-mpcw-3j5p-p99x","id":"tcs_01M5N95FJAF420HDNNNX291FX6","modified_at":"2024-12-04T05:40:43.793618Z","published_at":"2024-10-24T18:27:50Z","references":["https://osv.dev/vulnerability/GHSA-mpcw-3j5p-p99x","https://github.com/OpenRefine/simile-butterfly/security/advisories/GHSA-mpcw-3j5p-p99x","https://github.com/OpenRefine/simile-butterfly/commit/2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e","https://github.com/OpenRefine/simile-butterfly"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-mpcw-3j5p-p99x","url":"https://osv.dev/vulnerability/GHSA-mpcw-3j5p-p99x"}],"summary":"Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)"}