Skip to content
OpenAdvisories

Package · npm

renovate

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2020-37267

    Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

    Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs …

    renovatebot renovate renovate npm
  • High 7.5
    CVE-2019-25766

    Renovate before 19.38.7 Credential Exposure via Go Modules

    Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obt…

    renovatebot renovate renovate npm