[annotation]
id = "CVE/GHSA/NPM reference"

# related_ids = ["CVE1", "CVE2"]

date = "YYYY-MM-DD"

repository = ""

# Package url like format with scheme, type, namespace, name without version, qualifiers and subpath
# https://github.com/package-url/purl-spec
# Eg: pkg:maven/commons-io/commons-io or pkg:npm/amdefine or pkg:pypi/pillow
package = "pkg:maven/commons-io/commons-io"

# Optional: Related packages affected
# related_packages = { "pkg1" = "Version range", "pkg2" = "Version range" }

# Optional: Categories this advisory falls under. Valid categories are:
# "code-execution", "crypto-failure", "denial-of-service", "file-disclosure"
# "format-injection", "memory-corruption", "memory-exposure", "privilege-escalation"
categories = ["code-execution"]

# Freeform keywords which describe this vulnerability (optional)
keywords = ["prototype-pollution", ""]

cwe = ""

# URLs related to this vulnerability
related = [""]

# URL to any publicly available exploits
exploits = ""

# Metadata about the scope of the vulnerability
[affected]

# Table of canonical paths to vulnerable functions (optional)
# mapping to which versions impacted by this advisory used that particular
# name (e.g. if the function was renamed between versions).
# The path syntax is `package::path::to::function`, without any
# parameters or additional information, followed by a list of version reqs.

# Version range format - https://developer.github.com/v4/object/securityvulnerability/
# = 0.2.0 denotes a single vulnerable version.
# <= 1.0.8 denotes a version range up to and including the specified version
# < 0.1.11 denotes a version range up to, but excluding, the specified version
# >= 4.3.0, < 4.3.5 denotes a version range with a known minimum and maximum version.
# >= 0.0.1 denotes a version range with a known minimum, but no known maximum
# > 2.1.0, < 2.1.8
# > 2.0.0, <= 2.0.14
functions = { "package::MyClass::vulnerable_function" = ["< 1.2.0, >= 1.1.0"] }

# Versions which include fixes for this vulnerability (mandatory)
[versions]
patched = [">= 1.2.0"]

# Versions which were never vulnerable (optional)
#unaffected = ["< 1.1.0"]