GitHub Advisoryadvisory · npm

GHSA-6xhf-x49c-m5m6 Github Token Leak in aegir

HIGH Published 2018-07-24 Modified 2020-08-31 Official page ↗
Aliases
CVE-2017-16225
Ecosystem
npm
Packages
aegir
Severity
High
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• npm aegir: >= 12.0.0, < 12.0.8 → fixed in 12.0.8

Description

Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed. Recommendation Update to version 12.0.8 or later. If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.

Related

Alias · CVE (1)

  • CVE-2017-16225 aegir is a module to help automate JavaScript project management. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References