{"action":"Upgrade node-jszip to 3.5.0+dfsg-2 or later.","affected":[{"fixed":"3.5.0+dfsg-2","introduced":"0"}],"component":"node-jszip","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["3.5.0+dfsg-2"],"id":"tcs_01M5NFEY0KG8Z2K715XDFT753T","modified_at":"2026-10-23T18:04:50.109994393Z","published_at":"2021-07-25T13:15:07.390Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-23413","https://security-tracker.debian.org/tracker/CVE-2021-23413"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-23413","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-23413"}],"summary":"This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype"}