{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"20240707"}],"component":"org.fitnesse:fitnesse","cve_ids":["CVE-2024-28125"],"ecosystem":"Maven","epss":0.00992,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-x9r9-48rm-4xm6","id":"tcs_01M5N9J2XMZKFXFB19JYSX3RZZ","modified_at":"2025-09-19T18:54:10.508175Z","published_at":"2024-03-18T09:30:30Z","references":["https://osv.dev/vulnerability/GHSA-x9r9-48rm-4xm6","https://nvd.nist.gov/vuln/detail/CVE-2024-28125","https://github.com/unclebob/fitnesse","https://github.com/unclebob/fitnesse/blob/master/SECURITY.md","https://jvn.jp/en/jp/JVN94521208","http://fitnesse.org/FitNesseDownload"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-x9r9-48rm-4xm6","url":"https://osv.dev/vulnerability/GHSA-x9r9-48rm-4xm6"}],"summary":"FitNesse allows execution of arbitrary OS commands"}