GHSA-qfcv-5whw-7pcwCriticalCVSS 9.6

Exposure of Sensitive Information to an Unauthorized Actor in AEgir

Published
May 27, 2020
Last Modified
October 10, 2023

🔗 CVE IDs covered (1)

CVE-2020-11059 →

📋 Description

Impact

aegir publish and aegir build may leak secrets from environmental variables in the browser bundle published to npm.

Patches

The code has been patched, users should upgrade to >= 21.10.1

Workarounds

Run printenv to check your environment variables and revoke any secrets.

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • npm/aegir:>= 21.7.0, < 21.10.1

🔗 References (4)