GHSA-6xhf-x49c-m5m6High

Github Token Leak in aegir

Published
July 24, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-16225 →

📋 Description

Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed.

Recommendation

Update to version 12.0.8 or later.

If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.

🎯 Affected products1

  • npm/aegir:>= 12.0.0, <= 12.0.7

🔗 References (3)