GitHub personal access token leaking into temporary EasyBuild (debug) logs
Priority LOW 34CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.
Why it matters now
EPSS 0.00545 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed easybuild-framework (easybuilders): 4.1.2easybuild-framework (PyPI): 4.1.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| easybuilders | easybuild-framework | before 4.1.2 | 4.1.2 | Patch available | CNA |
| — | easybuild-framework (PyPI) | before 4.1.2 | 4.1.2 | Patch available | GHSA-2wx6-wc87-rmjm |
- easybuild-framework Vendoreasybuilders Affected before 4.1.2 Fixed in 4.1.2 Patch available CNA
- easybuild-framework (PyPI) Vendor— Affected before 4.1.2 Fixed in 4.1.2 Patch available GHSA-2wx6-wc87-rmjm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:easybuild_project:easybuild:*:*:*:*:*:*:*:* | before 4.1.2 | Vulnerable | Easybuild Project |
- cpe:2.3:a:easybuild_project:easybuild:*:*:*:*:*:*:*:* Versions before 4.1.2 Vulnerable ·Easybuild Project
Remediation
- Fix · CNA easybuild-framework (easybuilders) Fixed in 4.1.2
- Fix · GHSA-2wx6-wc87-rmjm easybuild-framework (PyPI) Fixed in 4.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5262
- 2026-10-03 Alias added: GHSA-2wx6-wc87-rmjm
References
Advisory 2
Other 4
- https://github.com/easybuilders/easybuild-framework/commit/210743d0e3618a8ac0a56eb9c0f4fa4fd8ae53b9
- https://github.com/easybuilders/easybuild-framework
- https://github.com/pypa/advisory-database/tree/main/vulns/easybuild-framework/PYSEC-2020-41.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/easybuild/PYSEC-2020-268.yaml
Sources
- CVE-2020-5262 · CVE Program
- CVE-2020-5262 · NVD
- FIRST EPSS
- GHSA-2wx6-wc87-rmjm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences