Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWptcW0tZjJneC00Zmp2

Sensitive information exposure through logs in npm-registry-fetch

Affected versions of npm-registry-fetch are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted and is printed to stdout and also to any generated log files.

Permalink: https://github.com/advisories/GHSA-jmqm-f2gx-4fjv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWptcW0tZjJneC00Zmp2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-jmqm-f2gx-4fjv
References:

• https://github.com/npm/npm-registry-fetch/security/advisories/GHSA-jmqm-f2gx-4fjv
• https://github.com/npm/npm-registry-fetch/pull/29
• https://github.com/npm/npm-registry-fetch/commit/18bf9b97fb1deecdba01ffb05580370846255c88
• https://snyk.io/vuln/SNYK-JS-NPMREGISTRYFETCH-575432
• https://github.com/advisories/GHSA-jmqm-f2gx-4fjv

Repository: https://github.com/npm/npm-registry-fetch
Blast Radius: 31.1

Affected Packages