{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.0.0.CR1","last_affected":"3.5.1"}],"component":"io.quarkus:quarkus-project","cve_ids":["CVE-2023-5720"],"ecosystem":"Maven","epss":0.00815,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-p62q-5483-h57v","id":"tcs_01M5N96K78F4F7EM20Q6YT1VC4","modified_at":"2026-09-10T03:50:04.274639Z","published_at":"2023-11-15T15:30:21Z","references":["https://osv.dev/vulnerability/GHSA-p62q-5483-h57v","https://nvd.nist.gov/vuln/detail/CVE-2023-5720","https://access.redhat.com/security/cve/CVE-2023-5720","https://bugzilla.redhat.com/show_bug.cgi?id=2245700","https://github.com/quarkusio/quarkus"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-p62q-5483-h57v","url":"https://osv.dev/vulnerability/GHSA-p62q-5483-h57v"}],"summary":"Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain"}