{"action":"Upgrade dbt-core to 1.7.3 or later.","affected":[{"fixed":"1.7.3","introduced":"1.7.0"}],"component":"dbt-core","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.7.3"],"ghsa_id":"GHSA-j4g3-3q8x-jxqp","id":"tcs_01M5KFN1XHHZ097K6YP2SH7DPK","modified_at":"2024-12-04T05:42:25.774437Z","published_at":"2023-12-08T15:38:37Z","references":["https://osv.dev/vulnerability/GHSA-j4g3-3q8x-jxqp","https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp","https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1","https://github.com/dbt-labs/dbt-core","https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3"],"severity":{"label":"low","score":3.2},"sources":[{"source":"osv","source_id":"GHSA-j4g3-3q8x-jxqp","url":"https://osv.dev/vulnerability/GHSA-j4g3-3q8x-jxqp"}],"summary":"dbt-core's secret env vars written to package-lock.json in plaintext"}