Read the docs
TI-2020-06175 Aliases CVE-2020-7654GHSA-mgh5-4h95-qj4p

Sensitive information in log files in snyk-broker

Priority LOW 35CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.

Why it matters now

EPSS 0.01122 66th percentileScored 2026-11-07
Fix Fixed snyk-broker: 4.73.1snyk-broker (npm): 4.73.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—snyk-brokerbefore 4.73.14.73.1Patch availableCNA
—snyk-broker (npm)before 4.73.14.73.1Patch availableGHSA-mgh5-4h95-qj4p
  • snyk-broker Vendor— Affected before 4.73.1 Fixed in 4.73.1 Patch available CNA
  • snyk-broker (npm) Vendor— Affected before 4.73.1 Fixed in 4.73.1 Patch available GHSA-mgh5-4h95-qj4p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synk:broker:*:*:*:*:*:*:*:*before 4.73.1VulnerableSynk
  • cpe:2.3:a:synk:broker:*:*:*:*:*:*:*:* Versions before 4.73.1 Vulnerable ·Synk

Remediation

  • Fix · CNA snyk-broker Fixed in 4.73.1
  • Fix · GHSA-mgh5-4h95-qj4p snyk-broker (npm) Fixed in 4.73.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7654
  2. 2026-10-03 Alias added: GHSA-mgh5-4h95-qj4p

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences