A CDN is supposed to allow sites to reference a remote, publicly available resource (e.g. a script, stylesheet, font, etc), rather than embedding it themselves, and allow the browser to cache it. If the CDN is compromised, then so is the resource.
For instance, let's say that the CDN for Bootstrap is compromised and somebody replaces it with a malign version that includes a keylogger. Every site that references the CDN will then download bootstrapThatTotallyHasntBeenCompromised.min.js and expose their users to a keylogger.
In the example above, the hackers uploaded a new version that spawned an alert on page load with a propaganda message. In this particular instance, it's not that severe (see the XKCD strip at the bottom of the article), but it could have been a lot worse.
EDIT: one thing that could help mitigate this is sub-resource integrity (SRI). This is just a fancy term for providing a checksum hash for the resource; if the hash from the downloaded resource doesn't match the hash that's published by the CDN, then the browser will block it. Troy Hunt has a bit more detail here.
Obviously, SRI doesn't help at all if the CDN deliberately uploads a malign version and publishes the hash for that, but that's a different kettle of fish entirely.