Read the docs
TI-2025-33551 Aliases CVE-2025-53624GHSA-qf34-qpr4-5pph

docusaurus-plugin-content-gists Exposes GitHub Personal Access Token

Priority MEDIUM 53CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02048 81st percentileScored 2026-11-07
Fix Fixed docusaurus-plugin-content-gists (webbertakken): 4.0.0docusaurus-plugin-content-gists (npm): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
webbertakkendocusaurus-plugin-content-gistsbefore 4.0.04.0.0Patch availableCNA
—docusaurus-plugin-content-gists (npm)before 4.0.04.0.0Patch availableGHSA-qf34-qpr4-5pph
  • docusaurus-plugin-content-gists Vendorwebbertakken Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
  • docusaurus-plugin-content-gists (npm) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-qf34-qpr4-5pph

Remediation

  • Fix · CNA docusaurus-plugin-content-gists (webbertakken) Fixed in 4.0.0
  • Fix · GHSA-qf34-qpr4-5pph docusaurus-plugin-content-gists (npm) Fixed in 4.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-53624
  2. 2026-10-03 Alias added: GHSA-qf34-qpr4-5pph

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences