{"action":"Upgrade aws-cdk-lib to 2.189.0 or later.","affected":[{"fixed":"2.189.0","introduced":"0"}],"component":"aws-cdk-lib","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.189.0"],"ghsa_id":"GHSA-5pq3-h73f-66hr","id":"tcs_01M5KF4C8YRS1KZRCMKS3PCT8J","modified_at":"2025-04-10T02:02:59Z","published_at":"2025-03-24T15:45:39Z","references":["https://osv.dev/vulnerability/GHSA-5pq3-h73f-66hr","https://github.com/aws/aws-cdk/security/advisories/GHSA-5pq3-h73f-66hr","https://github.com/aws/aws-cdk/issues/33709","https://github.com/aws/aws-cdk/commit/a64b01cc2969822bb92d7bd72152ecb2ccf1c1cf","https://github.com/aws/aws-cdk","https://github.com/aws/aws-cdk/releases/tag/v2.184.0"],"severity":{"label":"low","score":3.8},"sources":[{"source":"osv","source_id":"GHSA-5pq3-h73f-66hr","url":"https://osv.dev/vulnerability/GHSA-5pq3-h73f-66hr"}],"summary":"AWS CDK CodePipeline: trusted entities are too broad"}