Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
### Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. ### Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. ### Workarounds Disable Go Modules support. ### References Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure ### For more information If you have any questions or comments about this advisory: * Open an issue in [Renovate](http://github.com/renovatebot/renovate)
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | renovate (npm) | 13.87.0 to before 19.38.7 | 19.38.7 | Patch available | GHSA-v7x3-7hw7-pcjg |
- renovate (npm) Vendor— Affected 13.87.0 to before 19.38.7 Fixed in 19.38.7 Patch available GHSA-v7x3-7hw7-pcjg
Remediation
- Fix · GHSA-v7x3-7hw7-pcjg renovate (npm) Fixed in 19.38.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-v7x3-7hw7-pcjg
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences