Exposure of Sensitive Information to an Unauthorized Actor in AEgir
Priority MEDIUM 43CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.
Why it matters now
EPSS 0.0112 66th percentileScored 2026-11-07
Fix Fixed AEgir (IPFS): 21.10.1aegir (npm): 21.10.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ipfs | AEgir | 21.7.0 to before 21.10.1 | 21.10.1 | Patch available | CNA |
| — | aegir (npm) | 21.7.0 to before 21.10.1 | 21.10.1 | Patch available | GHSA-qfcv-5whw-7pcw |
- AEgir Vendoripfs Affected 21.7.0 to before 21.10.1 Fixed in 21.10.1 Patch available CNA
- aegir (npm) Vendor— Affected 21.7.0 to before 21.10.1 Fixed in 21.10.1 Patch available GHSA-qfcv-5whw-7pcw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aegir_project:aegir:*:*:*:*:*:node.js:*:* | 21.7.0 to before 21.10.1 | Vulnerable | Aegir Project |
- cpe:2.3:a:aegir_project:aegir:*:*:*:*:*:node.js:*:* Versions 21.7.0 to before 21.10.1 Vulnerable ·Aegir Project
Remediation
- Fix · CNA AEgir (IPFS) Fixed in 21.10.1
- Fix · GHSA-qfcv-5whw-7pcw aegir (npm) Fixed in 21.10.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11059
- 2026-10-03 Alias added: GHSA-qfcv-5whw-7pcw
References
More ipfs vulnerabilities
- TI-2023-09455 Denial of service when feeding malformed size arguments in go-bitfield CVSS 3.1HIGH 7.5
- TI-2023-10871 Boxo bitswap/server: DOS unbounded persistent memory leak CVSS 3.1HIGH 8.2
- TI-2022-07554 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag CVSS 3.1HIGH 7.5
- TI-2020-16104 Control character injection in console output CVSS 3.1HIGH 8.8
- TI-2020-16100 Path traversal in ipfs go-ipfs CVSS 3.1HIGH 8.1
- TI-2016-08604 Cryptographic flaw in HackerOne go-ipfs-dep node module CVSS 3.0HIGH 8.1
Sources
- CVE-2020-11059 · CVE Program
- CVE-2020-11059 · NVD
- FIRST EPSS
- GHSA-qfcv-5whw-7pcw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences