Vulnerability GHSA-v7x3-7hw7-pcjg

Medium Risk

7 years ago

Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

13.180.4 - 18.30.6

Summary

Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments

Details

Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

Workarounds

Disable Go Modules support.

References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

For more information

If you have any questions or comments about this advisory:

Open an issue in Renovate

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

6 months ago

Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance

43.65.0 - 43.102.10 GHSA-5vjq-5jmg-39xq

Medium Risk

8 months ago

Child processes spawned by Renovate incorrectly have full access to environment variables

42.68.1 - 42.96.2 and 43.0.0 - 43.4.3 GHSA-8wc6-vgrq-x6cf

Medium Risk

9 months ago

Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

31.51.0 - 40.32.7 GHSA-3f44-xw83-3pmg

Medium Risk

9 months ago

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

39.53.0 - 40.32.7 GHSA-xjr7-3c3g-m763

Medium Risk

9 months ago

Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies

32.135.0 - 40.32.7 GHSA-36j9-mx87-2cff

View all vulnerabilities for these packages

Impacted packages

renovate

Timeline

Published

7 years ago

Last Modified

3 hours ago