What is GHSA-v7x3-7hw7-pcjg?

GHSA-v7x3-7hw7-pcjg is a security advisory published by GitHub Security Advisories with Medium severity. Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

Why does GHSA-v7x3-7hw7-pcjg have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-v7x3-7hw7-pcjg?

GHSA-v7x3-7hw7-pcjg has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-v7x3-7hw7-pcjg?

GHSA-v7x3-7hw7-pcjg affects 1 product, including: npm/renovate:\u003e= 13.87.0, \u003c 19.38.7.

GHSA-v7x3-7hw7-pcjgMediumCVSS 5.3Disclosed before NVD

Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

Vendor

GitHub Security Advisories

Published

October 21, 2019

Last Modified

January 7, 2023

📋 Description

Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

Workarounds

Disable Go Modules support.

References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

For more information

If you have any questions or comments about this advisory:

Open an issue in Renovate

🎯 Affected products1

npm/renovate:>= 13.87.0, < 19.38.7

🔗 References (3)

https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
https://github.com/advisories/GHSA-v7x3-7hw7-pcjg
https://snyk.io/vuln/SNYK-JS-RENOVATE-536203