GitHub Advisoryadvisory · npm

GHSA-fp2w-g92g-fgq4 @nuxtlabs/github-module made Use of Hard-coded Credentials

CRITICAL Published 2023-04-18 Modified 2023-04-21 Official page ↗
Aliases
CVE-2023-2138
Ecosystem
npm
Packages
@nuxtlabs/github-module
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-798
Reviewed
2023-04-21

Affected packages

• npm @nuxtlabs/github-module: < 1.6.2 → fixed in 1.6.2

Description

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under `nuxt`, `nuxtlabs` and `nuxt-themes` GitHub organizations. A patch in version 1.6.2 fixed the issue.

Related

Alias · CVE (1)

  • CVE-2023-2138 Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References