{"action":"Upgrade hashi-vault-js to 0.5.2 or later.","affected":[{"fixed":"0.5.2","introduced":"0"}],"component":"hashi-vault-js","cve_ids":["CVE-2026-55102"],"ecosystem":"npm","epss":0.00161,"exploited":false,"fixed_versions":["0.5.2"],"ghsa_id":"GHSA-5pq8-3ffp-7w5m","id":"tcs_01M5KF4CR0E2K116RYTBADJQPR","modified_at":"2026-08-13T14:41:01.148534Z","published_at":"2026-08-13T14:14:32Z","references":["https://osv.dev/vulnerability/GHSA-5pq8-3ffp-7w5m","https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m","https://github.com/kyndryl-open-source/hashi-vault-js"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5pq8-3ffp-7w5m","url":"https://osv.dev/vulnerability/GHSA-5pq8-3ffp-7w5m"}],"summary":"hashi-vault-js: Vault token and secret values exposed in thrown errors"}