CGA-vrf9-252r-qxvx

CVE is present in /usr/share/scala/bin/scala-cli.jar which is downloaded during build from https://github.com/VirtusLab/scala-cli/releases. It is not a direct dependency so we must wait for both github.com/VirtusLab/scala-cli to update and release and then github.com/scala/scala3 to consume this new scala-cli release.