{
  "advisoryKey": "GHSA-aaaa-bbbb-cccc",
  "affectedPackages": [
    {
      "identifier": "pkg:npm/example-widget",
      "platform": null,
      "provenance": [
        {
          "fieldMask": [],
          "kind": "map",
          "recordedAt": "2024-03-05T10:00:00+00:00",
          "source": "ghsa",
          "value": "ghsa-aaaa-bbbb-cccc"
        }
      ],
      "statuses": [],
      "type": "semver",
      "versionRanges": [
        {
          "fixedVersion": "2.5.1",
          "introducedVersion": null,
          "lastAffectedVersion": null,
          "primitives": null,
          "provenance": {
            "fieldMask": [],
            "kind": "map",
            "recordedAt": "2024-03-05T10:00:00+00:00",
            "source": "ghsa",
            "value": "ghsa-aaaa-bbbb-cccc"
          },
          "rangeExpression": ">=0.0.0 <2.5.1",
          "rangeKind": "semver"
        },
        {
          "fixedVersion": "3.2.4",
          "introducedVersion": "3.0.0",
          "lastAffectedVersion": null,
          "primitives": null,
          "provenance": {
            "fieldMask": [],
            "kind": "map",
            "recordedAt": "2024-03-05T10:00:00+00:00",
            "source": "ghsa",
            "value": "ghsa-aaaa-bbbb-cccc"
          },
          "rangeExpression": null,
          "rangeKind": "semver"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-2222",
    "GHSA-aaaa-bbbb-cccc"
  ],
  "cvssMetrics": [
    {
      "baseScore": 8.8,
      "baseSeverity": "high",
      "provenance": {
        "fieldMask": [],
        "kind": "map",
        "recordedAt": "2024-03-05T10:00:00+00:00",
        "source": "ghsa",
        "value": "ghsa-aaaa-bbbb-cccc"
      },
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "version": "3.1"
    }
  ],
  "exploitKnown": false,
  "language": "en",
  "modified": "2024-03-04T12:00:00+00:00",
  "provenance": [
    {
      "fieldMask": [],
      "kind": "map",
      "recordedAt": "2024-03-05T10:00:00+00:00",
      "source": "ghsa",
      "value": "ghsa-aaaa-bbbb-cccc"
    }
  ],
  "published": "2024-03-04T00:00:00+00:00",
  "references": [
    {
      "kind": "patch",
      "provenance": {
        "fieldMask": [],
        "kind": "map",
        "recordedAt": "2024-03-05T10:00:00+00:00",
        "source": "ghsa",
        "value": "ghsa-aaaa-bbbb-cccc"
      },
      "sourceTag": "ghsa",
      "summary": "Patch commit",
      "url": "https://github.com/example/widget/commit/abcd1234"
    },
    {
      "kind": "advisory",
      "provenance": {
        "fieldMask": [],
        "kind": "map",
        "recordedAt": "2024-03-05T10:00:00+00:00",
        "source": "ghsa",
        "value": "ghsa-aaaa-bbbb-cccc"
      },
      "sourceTag": "ghsa",
      "summary": "GitHub Security Advisory",
      "url": "https://github.com/example/widget/security/advisories/GHSA-aaaa-bbbb-cccc"
    }
  ],
  "severity": "high",
  "summary": "A crafted payload can pollute Object.prototype leading to RCE.",
  "title": "Prototype pollution in widget.js"
}