{"action":"Upgrade @cubejs-backend/api-gateway to 0.11.17 or later.","affected":[{"fixed":"0.11.17","introduced":"0.11.0"}],"component":"@cubejs-backend/api-gateway","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.11.17"],"ghsa_id":"GHSA-4j6x-w426-6rc6","id":"tcs_01M5KF0QEBHFQXVZNW39GGWJGN","modified_at":"2020-06-16T20:58:26Z","published_at":"2019-11-08T17:31:17Z","references":["https://osv.dev/vulnerability/GHSA-4j6x-w426-6rc6","https://github.com/cube-js/cube.js/security/advisories/GHSA-4j6x-w426-6rc6","https://github.com/advisories/GHSA-4j6x-w426-6rc6"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-4j6x-w426-6rc6","url":"https://osv.dev/vulnerability/GHSA-4j6x-w426-6rc6"}],"summary":"Default Express middleware security check is ignored in production"}