From 8c23942133af0be9ceaf18a8d4b7c07baf0f13a2 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 11 Sep 2023 18:20:20 +0000
Subject: [PATCH] Publish GHSA-82gw-pqf7-q3j2

---
 .../GHSA-82gw-pqf7-q3j2/GHSA-82gw-pqf7-q3j2.json  | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2018/03/GHSA-82gw-pqf7-q3j2/GHSA-82gw-pqf7-q3j2.json b/advisories/github-reviewed/2018/03/GHSA-82gw-pqf7-q3j2/GHSA-82gw-pqf7-q3j2.json
index ebbfb3ab441..334241e4008 100644
--- a/advisories/github-reviewed/2018/03/GHSA-82gw-pqf7-q3j2/GHSA-82gw-pqf7-q3j2.json
+++ b/advisories/github-reviewed/2018/03/GHSA-82gw-pqf7-q3j2/GHSA-82gw-pqf7-q3j2.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-82gw-pqf7-q3j2",
-  "modified": "2021-09-03T21:50:02Z",
+  "modified": "2023-09-11T18:19:05Z",
   "published": "2018-03-13T20:38:51Z",
   "aliases": [
     "CVE-2018-1000086"
   ],
-  "summary": "High severity vulnerability that affects pym.js",
-  "details": "NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. \n\nhttps://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.",
+  "summary": "pym.js CSRF Vulnerability",
+  "details": "NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js `_onNavigateToMessage` function. \n\nhttps://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 can result in Arbitrary javascript code execution. This attack appears to be exploitable if the Attacker gains full javascript access to pages with Pym.js embeds, or when user visits an attacker-crafted page. This vulnerability appears to have been fixed in versions 1.3.2 and later.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -20,6 +20,11 @@
         "ecosystem": "npm",
         "name": "pym.js"
       },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
       "ranges": [
         {
           "type": "ECOSYSTEM",
@@ -47,6 +52,10 @@
       "type": "WEB",
       "url": "https://github.com/nprapps/pym.js/issues/170"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/nprapps/pym.js/commit/c3552a6cf2532664c17bd6a318fb3cf8e4cf2f97"
+    },
     {
       "type": "ADVISORY",
       "url": "https://github.com/advisories/GHSA-82gw-pqf7-q3j2"