GHSA-qfcv-5whw-7pcw

Exposure of Sensitive Information to an Unauthorized Actor in AEgir

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-11059

Packages

Ecosystem	Package	Affected	Fixed in
npm	aegir	>= 21.7.0, < 21.10.1	21.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact `aegir publish` and `aegir build` may leak secrets from environmental variables in the browser bundle published to npm. ### Patches The code has been patched, users should upgrade to >= 21.10.1 ### Workarounds Run `printenv` to check your environment variables and revoke any secrets. ### For more information If you have any questions or comments about this advisory: * Open an issue in [aegir](https://github.com/ipfs/aegir)

References

External links from the advisory. They lead to third-party sites.

https://github.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw web
https://nvd.nist.gov/vuln/detail/CVE-2020-11059 advisory
https://github.com/ipfs/aegir/commit/e36e1def57b2dc1e4b7a5beba964c5924e87f8d8 web
https://github.com/ipfs/aegir package