GHSA-jmqm-f2gx-4fjvMediumCVSS 5.3Disclosed before NVD

Sensitive information exposure through logs in npm-registry-fetch

Published
July 7, 2020
Last Modified
January 9, 2023

📋 Description

Affected versions of npm-registry-fetch are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted and is printed to stdout and also to any generated log files.

🎯 Affected products2

  • npm/npm-registry-fetch:< 4.0.5
  • npm/npm-registry-fetch:>= 5.0.0, < 8.1.1

🔗 References (5)