Credentials management flaw in HackerOne grunt-gh-pages node module
Priority MEDIUM 40CWE-391Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
Why it matters now
EPSS 0.01612 76th percentileScored 2026-11-07
Fix Fixed grunt-gh-pages (npm): 0.10.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackerOne | grunt-gh-pages node module | up to 0.9.1 | — | No fix listed | CNA |
| — | grunt-gh-pages (npm) | before 0.10.0 | 0.10.0 | Patch available | GHSA-rrj3-qmh8-72pf |
- grunt-gh-pages node module VendorHackerOne Affected up to 0.9.1 Fixed in — No fix listed CNA
- grunt-gh-pages (npm) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-rrj3-qmh8-72pf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:grunt-gh-pages_project:grunt-gh-pages:*:*:*:*:*:node.js:*:* | before 0.9.1 | Vulnerable | Grunt-gh-pages Project |
- cpe:2.3:a:grunt-gh-pages_project:grunt-gh-pages:*:*:*:*:*:node.js:*:* Versions before 0.9.1 Vulnerable ·Grunt-gh-pages Project
Remediation
- Fix · GHSA-rrj3-qmh8-72pf grunt-gh-pages (npm) Fixed in 0.10.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10526
- 2026-10-03 Alias added: GHSA-rrj3-qmh8-72pf
References
Advisory 3
Sources
- CVE-2016-10526 · CVE Program
- CVE-2016-10526 · NVD
- FIRST EPSS
- GHSA-rrj3-qmh8-72pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences