[GHSA-qvqv-mcxr-x8qw] Slim Select 2.0 versions through 2.9.0 are affected by a...

[m3t3kh4n]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Source code location
• Summary

Comments

• Title was added
• Source Code Location was added
• Affected products were added
• CVSSv3 assessment was recalculated
• CVSSv4 assessment was recalculated

[shelbyc]

Hi @m3t3kh4n, I'm merging the pull request but have chosen to publish the GHSA at a low severity. This is because the Vulncheck advisory and the thread at brianvoe/slim-select#564 notes a publicly available proof of concept but no evidence of exploitation in the wild, which results in a low severity per https://www.first.org/cvss/calculator/v4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P.

[advisory-database]

Hi @m3t3kh4n! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!