{"action":"Upgrade @aws-cdk/aws-eks to 1.202.0 or later.","affected":[{"fixed":"1.202.0","introduced":"1.57.0"}],"component":"@aws-cdk/aws-eks","cve_ids":["CVE-2023-35165"],"ecosystem":"npm","epss":0.00897,"exploited":false,"fixed_versions":["1.202.0"],"ghsa_id":"GHSA-rx28-r23p-2qc3","id":"tcs_01M5KGA6NYPPD19JWYXZBB7RJH","modified_at":"2026-09-10T03:49:42.502343293Z","published_at":"2023-06-19T22:47:26Z","references":["https://osv.dev/vulnerability/GHSA-rx28-r23p-2qc3","https://github.com/aws/aws-cdk/security/advisories/GHSA-rx28-r23p-2qc3","https://nvd.nist.gov/vuln/detail/CVE-2023-35165","https://github.com/aws/aws-cdk/issues/25674","https://github.com/aws/aws-cdk"],"severity":{"label":"medium","score":6.6},"sources":[{"source":"osv","source_id":"GHSA-rx28-r23p-2qc3#npm/@aws-cdk/aws-eks","url":"https://osv.dev/vulnerability/GHSA-rx28-r23p-2qc3"}],"summary":"AWS CDK EKS overly permissive trust policies"}