GitHub Advisoryadvisory · npm

GHSA-rrj3-qmh8-72pf grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file

MEDIUM Published 2019-02-18 Modified 2022-08-03 Official page ↗
Aliases
CVE-2016-10526
Ecosystem
npm
Packages
grunt-gh-pages
Severity
Moderate
Weaknesses
CWE-391
Reviewed
2020-06-16

Affected packages

• npm grunt-gh-pages: < 0.10.0 → fixed in 0.10.0

Description

Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances. In the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted. Recommendation Update to version 0.10.0 or later.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2016-10526 A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth… vulnerability

References