{"action":"Upgrade @cyclonedx/cdxgen to 12.3.3 or later.","affected":[{"fixed":"12.3.3","introduced":"9.9.5"}],"component":"@cyclonedx/cdxgen","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["12.3.3"],"ghsa_id":"GHSA-qhh4-458h-xwh2","id":"tcs_01M5KG67GCK5HP1D5E66WDP0PS","modified_at":"2026-05-08T20:36:35.342191Z","published_at":"2026-05-08T20:06:00Z","references":["https://osv.dev/vulnerability/GHSA-qhh4-458h-xwh2","https://github.com/cdxgen/cdxgen/security/advisories/GHSA-qhh4-458h-xwh2","https://github.com/cdxgen/cdxgen"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-qhh4-458h-xwh2","url":"https://osv.dev/vulnerability/GHSA-qhh4-458h-xwh2"}],"summary":"@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry"}