Read the docs
TI-2017-11944 Aliases CVE-2017-16225GHSA-6xhf-x49c-m5m6

Information disclosure in HackerOne aegir node module

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.

Why it matters now

EPSS 0.01158 67th percentileScored 2026-11-07
Fix Fixed aegir (npm): 12.0.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HackerOneaegir node module>=12.0.0 <= 12.0.7—No fix listedCNA
—aegir (npm)12.0.0 to before 12.0.812.0.8Patch availableGHSA-6xhf-x49c-m5m6
  • aegir node module VendorHackerOne Affected >=12.0.0 <= 12.0.7 Fixed in — No fix listed CNA
  • aegir (npm) Vendor— Affected 12.0.0 to before 12.0.8 Fixed in 12.0.8 Patch available GHSA-6xhf-x49c-m5m6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aegir_project:aegir:*:*:*:*:*:node.js:*:*12.0.0 – 12.0.7VulnerableAegir Project
  • cpe:2.3:a:aegir_project:aegir:*:*:*:*:*:node.js:*:* Versions 12.0.0 – 12.0.7 Vulnerable ·Aegir Project

Remediation

  • Fix · GHSA-6xhf-x49c-m5m6 aegir (npm) Fixed in 12.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-16225
  2. 2026-10-03 Alias added: GHSA-6xhf-x49c-m5m6

References

Advisory 3

Other 1

  • TI-2020-08933 Exposure of Sensitive Information to an Unauthorized Actor in AEgir CVSS 3.1CRITICAL 9.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences