fix vulnerability