{"action":"Upgrade aws-cdk-lib to 2.187.0 or later.","affected":[{"fixed":"2.187.0","introduced":"2.37.0"}],"component":"aws-cdk-lib","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2.187.0"],"ghsa_id":"GHSA-qq4x-c6h6-rfxh","id":"tcs_01M5KG6SXVDMN5D8HM68TV6DA1","modified_at":"2025-03-31T22:37:42Z","published_at":"2025-03-31T22:37:42Z","references":["https://osv.dev/vulnerability/GHSA-qq4x-c6h6-rfxh","https://github.com/aws/aws-cdk/security/advisories/GHSA-qq4x-c6h6-rfxh","https://github.com/aws/aws-cdk/commit/d02e64aac18a72195ddcdb973defea7f32382c33","https://github.com/aws/aws-cdk"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-qq4x-c6h6-rfxh","url":"https://osv.dev/vulnerability/GHSA-qq4x-c6h6-rfxh"}],"summary":"aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct"}