GitHub Advisoryadvisory · npm

GHSA-pc2q-jcxq-rjrr Sensitive Information leak via Script File in TinaCMS

HIGH Published 2023-02-08 Modified 2023-02-08 Official page ↗
Aliases
CVE-2023-25164
Ecosystem
npm
Packages
@tinacms/cli
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-02-08

Affected packages

• npm @tinacms/cli: >= 1.0.0, < 1.0.9 → fixed in 1.0.9

Description

Impact Sensitive Information leaked via script File in TinaCMS. Sites building with @tinacms/cli >= 1.0.0 && < 1.0.9 that store sensitive values in process.env var are impacted. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. Patches This issue has been patched in @tinacms/[email protected] Workarounds Upgrading, and rotating secure & exposed keys is required for the proper fix. References https://github.com/tinacms/tinacms/pull/3584

Related

Alias · CVE (1)

  • CVE-2023-25164 Tinacms is a Git-backed headless content management system with support for visual editing. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References