PT-2026-78370

CVE-2019-25766

·

Published

2019-10-21

·

Updated

2026-08-25

Description by

CVSS 4.0
8.7
High
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Renovate versions 13.87.0 through 19.38.6
Description Temporary repository tokens are leaked into pull request comments when certain Go Modules update failure scenarios occur. This allows any user with permissions to view the affected pull request comments to obtain the exposed tokens.
Recommendations Update to version 19.38.7.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-532: Insertion of Sensitive Information into Log File
Related identifiers
CVE-2019-25766
GHSA-V7X3-7HW7-PCJG
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com