Threats affecting pkg:github/nxp-auto-goldvip/gvip

CVE-2026-19359 is a medium severity vulnerability in the nxp-auto-goldvip gvip product up to version 1.4.0. It involves improper access controls in the SitewiseCustomFunction of the Lambda Function Handler component, allowing remote attackers to exploit the issue. The vulnerability stems from a known historical IAM permission misconfiguration that was addressed starting with version 1.13.0 and improved in subsequent releases including 1.15.0. Users are advised to upgrade to version 1.15.0 or later to resolve the issue. The vendor has also requested updating or deprecating older releases in the AWS SAR repository. The product is a cloud service, so remediation is managed by the vendor.