{"action":"Upgrade @lightdash/cli to 0.2695.1 or later.","affected":[{"fixed":"0.2695.1","introduced":"0.1800.0"}],"component":"@lightdash/cli","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.2695.1"],"ghsa_id":"GHSA-3hfp-gqgh-xc5g","id":"tcs_01M5KEXDFS74HF8GARQBJQKDFJ","modified_at":"2026-04-02T18:53:28.873335Z","published_at":"2026-04-02T18:36:10Z","references":["https://osv.dev/vulnerability/GHSA-3hfp-gqgh-xc5g","https://github.com/lightdash/lightdash/security/advisories/GHSA-3hfp-gqgh-xc5g","https://github.com/axios/axios/issues/10604","https://github.com/advisories/GHSA-fw8c-xr5c-95f9","https://github.com/lightdash/lightdash","https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650","https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652","https://socket.dev/blog/axios-npm-package-compromised","https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html","https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-3hfp-gqgh-xc5g","url":"https://osv.dev/vulnerability/GHSA-3hfp-gqgh-xc5g"}],"summary":"Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions"}