VDB
Sign up
HIGH

GHSA-6xhf-x49c-m5m6

Github Token Leak in aegir

Quick fix

GHSA-6xhf-x49c-m5m6 — aegir: upgrade to the fixed version with the command below.

npm install aegir@12.0.8

Details

Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed.

## Recommendation

Update to version 12.0.8 or later.

If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/aegir
Introduced in: 12.0.0Fixed in: 12.0.8
Fixnpm install aegir@12.0.8

References