~ / search / GHSA-93f3-23rq-pjfp

GHSA-93f3-23rq-pjfp

npm CLI exposing sensitive information through logs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15095

Packages

EcosystemPackageAffectedFixed in
npm npm < 6.14.6 6.14.6

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.

References

External links from the advisory. They lead to third-party sites.