{"action":"Upgrade open-build-service to 2.9.4-4 or later.","affected":[{"fixed":"2.9.4-4","introduced":"0"}],"component":"open-build-service","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["2.9.4-4"],"id":"tcs_01M5NF8960WDE5K765TVQB7DAC","modified_at":"2026-10-26T12:02:16.929190704Z","published_at":"2020-05-13T15:15:11.700Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-8020","https://security-tracker.debian.org/tracker/CVE-2020-8020"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-8020","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-8020"}],"summary":"A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-bui"}