GHSA-fp2w-g92g-fgq4

@nuxtlabs/github-module made Use of Hard-coded Credentials

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-2138

Packages

Ecosystem	Package	Affected	Fixed in
npm	@nuxtlabs/github-module	< 1.6.2	1.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under `nuxt`, `nuxtlabs` and `nuxt-themes` GitHub organizations. A patch in version 1.6.2 fixed the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-2138 advisory
https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e web
https://github.com/nuxtlabs/github-module package
https://github.com/nuxtlabs/github-module/releases/tag/v1.6.2 web
https://huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6 web