Read the docs
TI-2025-18098 Aliases CVE-2025-24355GHSA-v34r-vj4r-38j6

Updatecli may expose Maven credentials in console output

Priority MEDIUM 64CWE-359Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-359.

Summary

Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Fix Fixed updatecli (updatecli): 0.93.0github.com/updatecli/updatecli (Go): 0.93.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
updatecliupdateclibefore 0.93.00.93.0Patch availableCNA
—github.com/updatecli/updatecli (Go)before 0.93.00.93.0Patch availableGHSA-v34r-vj4r-38j6
  • updatecli Vendorupdatecli Affected before 0.93.0 Fixed in 0.93.0 Patch available CNA
  • github.com/updatecli/updatecli (Go) Vendor— Affected before 0.93.0 Fixed in 0.93.0 Patch available GHSA-v34r-vj4r-38j6

Remediation

  • Fix · CNA updatecli (updatecli) Fixed in 0.93.0
  • Fix · GHSA-v34r-vj4r-38j6 github.com/updatecli/updatecli (Go) Fixed in 0.93.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24355
  2. 2026-10-03 Alias added: GHSA-v34r-vj4r-38j6

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences