{"ghsa": "GHSA-2fp4-5v5c-4448", "repo": "sentriz/gonic", "cwes": ["CWE-22", "CWE-639"], "summary": "fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist", "fix_commit": "6dd71e6a3c966867ef8c900d359a7df75789f410", "parent_commit": "37090aa71c5e0bb7a322313fc8622c828fd9916b", "vuln_files": ["server/ctrlsubsonic/handlers_playlist.go"], "vuln_lines": {"server/ctrlsubsonic/handlers_playlist.go": [51, 60, 177, 183]}, "source_files": 156, "scope_dirs": ["server/ctrlsubsonic"], "source_note": "Subset: only the server/ctrlsubsonic package (containing the vuln file) was copied into source/, not the full repo."}