{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19167?format=json","vulnerability_id":"VCID-b9th-m3ys-7bat","summary":"silverstripe/framework code execution vulnerability\nThere is a vulnerability whereby arbitrary global functions may be executed if malicious user input is passed through to in the second argument of `ViewableData::renderWith`. This argument resolves associative arrays as template placeholders. This exploit requires that user code has been written which makes use of the second argument in `renderWith` and where user input is passed directly as a value in an associative array without sanitisation such as `Convert::raw2xml()`.\n\n`ViewableData::customise` is not vulnerable.","aliases":[{"alias":"GHSA-vgxh-x8jv-hmff"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59974?format=json","purl":"pkg:composer/silverstripe/framework@4.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p2kq-rkh6-ayeu"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.4"},{"url":"http://public2.vulnerablecode.io/api/packages/59975?format=json","purl":"pkg:composer/silverstripe/framework@4.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-658d-vmwt-f7e8"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p2kq-rkh6-ayeu"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/145603?format=json","purl":"pkg:composer/silverstripe/framework@4.0.3-rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-b9th-m3ys-7bat"},{"vulnerability":"VCID-dgke-xzhn-dkg5"},{"vulnerability":"VCID-pffp-vtk7-pqby"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.3-rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/184882?format=json","purl":"pkg:composer/silverstripe/framework@4.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nes-cr3m-j3dv"},{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-b9th-m3ys-7bat"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-dgke-xzhn-dkg5"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-ff5q-59gf-nugg"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-jx5m-bqc6-h3bv"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p2kq-rkh6-ayeu"},{"vulnerability":"VCID-p554-wkxw-gfdh"},{"vulnerability":"VCID-pffp-vtk7-pqby"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-xnb4-zjws-vuhu"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/145601?format=json","purl":"pkg:composer/silverstripe/framework@4.1.0-rc1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nes-cr3m-j3dv"},{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-b9th-m3ys-7bat"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-dgke-xzhn-dkg5"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-ff5q-59gf-nugg"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-jx5m-bqc6-h3bv"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p554-wkxw-gfdh"},{"vulnerability":"VCID-pffp-vtk7-pqby"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-xnb4-zjws-vuhu"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.0-rc1"},{"url":"http://public2.vulnerablecode.io/api/packages/193720?format=json","purl":"pkg:composer/silverstripe/framework@4.1.0-rc2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nes-cr3m-j3dv"},{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-b9th-m3ys-7bat"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-dgke-xzhn-dkg5"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-ff5q-59gf-nugg"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-jx5m-bqc6-h3bv"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p554-wkxw-gfdh"},{"vulnerability":"VCID-pffp-vtk7-pqby"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-xnb4-zjws-vuhu"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.0-rc2"},{"url":"http://public2.vulnerablecode.io/api/packages/35957?format=json","purl":"pkg:composer/silverstripe/framework@4.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nes-cr3m-j3dv"},{"vulnerability":"VCID-2rbk-47h6-d7d8"},{"vulnerability":"VCID-4f9c-aun4-wfep"},{"vulnerability":"VCID-4x32-t75c-u3bj"},{"vulnerability":"VCID-5pkg-j4wg-7fcn"},{"vulnerability":"VCID-658d-vmwt-f7e8"},{"vulnerability":"VCID-6du5-hdvd-fueb"},{"vulnerability":"VCID-6epx-c68d-d7bv"},{"vulnerability":"VCID-7dk3-gcup-2kc9"},{"vulnerability":"VCID-86yd-4mkt-hydr"},{"vulnerability":"VCID-a3yc-fxa1-gfhy"},{"vulnerability":"VCID-ajga-3b99-yugh"},{"vulnerability":"VCID-axxx-gpfn-mqc9"},{"vulnerability":"VCID-b9th-m3ys-7bat"},{"vulnerability":"VCID-bdcq-z11u-zyh5"},{"vulnerability":"VCID-c75p-3hdz-q3b6"},{"vulnerability":"VCID-cdgj-bdpy-ukak"},{"vulnerability":"VCID-cfgg-fgjt-z3hn"},{"vulnerability":"VCID-d5q3-jrdb-euav"},{"vulnerability":"VCID-dc9y-v257-6bhf"},{"vulnerability":"VCID-dgke-xzhn-dkg5"},{"vulnerability":"VCID-enkd-4y44-4ueq"},{"vulnerability":"VCID-ff5q-59gf-nugg"},{"vulnerability":"VCID-fpb7-5pwu-tyg5"},{"vulnerability":"VCID-ftdr-uzuh-8ybc"},{"vulnerability":"VCID-fyxa-vzeq-ubeq"},{"vulnerability":"VCID-gme6-wj87-ekfw"},{"vulnerability":"VCID-jx5m-bqc6-h3bv"},{"vulnerability":"VCID-kak1-btjp-kqgz"},{"vulnerability":"VCID-kd3t-2gzd-q3hq"},{"vulnerability":"VCID-kgm4-g26x-gken"},{"vulnerability":"VCID-kvhv-9fj5-7kgk"},{"vulnerability":"VCID-kw9p-5fbc-hudg"},{"vulnerability":"VCID-kxa8-dmva-ayff"},{"vulnerability":"VCID-kxyq-vg6e-6uac"},{"vulnerability":"VCID-m8w1-g9h9-vuce"},{"vulnerability":"VCID-p2kq-rkh6-ayeu"},{"vulnerability":"VCID-p554-wkxw-gfdh"},{"vulnerability":"VCID-pffp-vtk7-pqby"},{"vulnerability":"VCID-pq29-qe7h-tkcp"},{"vulnerability":"VCID-qak9-2t7g-w3fv"},{"vulnerability":"VCID-qjgf-hxng-j3g9"},{"vulnerability":"VCID-qm38-1cwk-b3hq"},{"vulnerability":"VCID-tc2y-zrea-vyb2"},{"vulnerability":"VCID-u49v-31sv-eqc3"},{"vulnerability":"VCID-ua49-snhx-dqa4"},{"vulnerability":"VCID-w4fh-cpaq-nqat"},{"vulnerability":"VCID-xnb4-zjws-vuhu"},{"vulnerability":"VCID-yuer-yn1w-q3gw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/silverstripe/framework@4.1.0"}],"references":[{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-006-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-006-1.yaml"},{"reference_url":"https://github.com/silverstripe/silverstripe-framework","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/silverstripe/silverstripe-framework"},{"reference_url":"https://github.com/silverstripe/silverstripe-framework/commit/6f50728b185e62c0087a58b295a015cb13276911","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/silverstripe/silverstripe-framework/commit/6f50728b185e62c0087a58b295a015cb13276911"},{"reference_url":"https://www.silverstripe.org/download/security-releases/ss-2018-006","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.silverstripe.org/download/security-releases/ss-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-vgxh-x8jv-hmff","reference_id":"GHSA-vgxh-x8jv-hmff","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-vgxh-x8jv-hmff"}],"weaknesses":[{"cwe_id":74,"name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":"0.5","weighted_severity":"8.0","risk_score":4.0,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b9th-m3ys-7bat"}