GitHub Advisoryadvisory · npm

GHSA-v7x3-7hw7-pcjg Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

MEDIUM Published 2019-10-21 Modified 2022-08-11 Official page ↗
Ecosystem
npm
Packages
renovate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-200
Reviewed
2020-06-16

Affected packages

• npm renovate: >= 13.87.0, < 19.38.7 → fixed in 19.38.7

Description

Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. Workarounds Disable Go Modules support. References Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure For more information If you have any questions or comments about this advisory: • Open an issue in Renovate

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References