lightdash @lightdash/cli vulnerabilities

Latest lightdash @lightdash/cli CVEs

Newest publication first

1. GHSA-3hfp-gqgh-xc5g Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

   Published 2026-04-02

   Critical·CVSS 9.6

   Impact A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (plain-crypto-js@4.2.1) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.