{"action":"Upgrade aws-cdk-lib to 2.189.1 or later.","affected":[{"fixed":"2.189.1","introduced":"2.172.0"}],"component":"aws-cdk-lib","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.189.1"],"ghsa_id":"GHSA-qc59-cxj2-c2w4","id":"tcs_01M5KG5V5Q6GATM0CRCD89S0AK","modified_at":"2025-04-15T14:48:49Z","published_at":"2025-04-15T14:48:49Z","references":["https://osv.dev/vulnerability/GHSA-qc59-cxj2-c2w4","https://github.com/aws/aws-cdk/security/advisories/GHSA-qc59-cxj2-c2w4","https://github.com/aws/aws-cdk/commit/b7f4bc7aee1d99b70e4d9d3cedea53e910ee37ef","https://github.com/aws/aws-cdk","https://github.com/aws/aws-cdk/releases/tag/v2.189.1"],"severity":{"label":"low","score":2.2},"sources":[{"source":"osv","source_id":"GHSA-qc59-cxj2-c2w4","url":"https://osv.dev/vulnerability/GHSA-qc59-cxj2-c2w4"}],"summary":"aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role"}