This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23423.json"