Hi there @jbogard! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

@mkarbowski-quilt I have a discussion specifically for this advisory here: LuckyPennySoftware/AutoMapper#4624

I detail there how to verify, patch, apply workarounds, suppress the warning etc.

The scores are automatically calculated by CVSS (not me).

Hi @mkarbowski-quilt,
We understand the frustration this may have caused. @jbogard has provided detailed rationale and verification/mitigation guidance in the linked discussion, and the severity is based on CVSS calculation. Based on this information, we’re inclined to agree with the assessment and scoring for this vulnerability. We will add LuckyPennySoftware/AutoMapper#4624 to the references of this advisory as requested in #7230.