{"action":"Upgrade aws-cdk-lib to 2.80.0 or later.","affected":[{"fixed":"2.80.0","introduced":"2.0.0"}],"component":"aws-cdk-lib","cve_ids":["CVE-2023-35165"],"ecosystem":"npm","epss":0.00897,"exploited":false,"fixed_versions":["2.80.0"],"ghsa_id":"GHSA-rx28-r23p-2qc3","id":"tcs_01M5KGA6FG9A87ZYFK4SNYHQMK","modified_at":"2026-09-10T03:49:42.502343293Z","published_at":"2023-06-19T22:47:26Z","references":["https://osv.dev/vulnerability/GHSA-rx28-r23p-2qc3","https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3","https://nvd.nist.gov/vuln/detail/CVE-2023-35165","https://github.com/aws/aws-cdk/issues/25674","https://github.com/aws/aws-cdk"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-rx28-r23p-2qc3","url":"https://osv.dev/vulnerability/GHSA-rx28-r23p-2qc3"}],"summary":"AWS CDK EKS overly permissive trust policies"}