From b40d2ded9dddfc1c9f744d776bd5313b5f4c9636 Mon Sep 17 00:00:00 2001
From: Malcolm Young <428782+malcomio@users.noreply.github.com>
Date: Tue, 22 Sep 2026 12:11:31 +0100
Subject: [PATCH] Improve GHSA-g9g6-gvq9-j4vp

---
 .../GHSA-g9g6-gvq9-j4vp.json                  | 27 ++++++++++++-------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/advisories/unreviewed/2026/07/GHSA-g9g6-gvq9-j4vp/GHSA-g9g6-gvq9-j4vp.json b/advisories/unreviewed/2026/07/GHSA-g9g6-gvq9-j4vp/GHSA-g9g6-gvq9-j4vp.json
index bd855edd930f..ec5d8cbdd0ff 100644
--- a/advisories/unreviewed/2026/07/GHSA-g9g6-gvq9-j4vp/GHSA-g9g6-gvq9-j4vp.json
+++ b/advisories/unreviewed/2026/07/GHSA-g9g6-gvq9-j4vp/GHSA-g9g6-gvq9-j4vp.json
@@ -1,23 +1,32 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g9g6-gvq9-j4vp",
-  "modified": "2026-07-06T09:30:27Z",
+  "modified": "2026-07-06T09:30:37Z",
   "published": "2026-07-06T09:30:27Z",
   "aliases": [
     "CVE-2026-14802"
   ],
+  "summary": "Command Injection in react-dev-utis",
   "details": "A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
-  "severity": [
+  "severity": [],
+  "affected": [
     {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
-    },
-    {
-      "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+      "package": {
+        "ecosystem": "npm",
+        "name": "react-dev-utils"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "12.0.1"
+            }
+          ]
+        }
+      ]
     }
   ],
-  "affected": [],
   "references": [
     {
       "type": "ADVISORY",