GHSA-rqjw-p5vr-c695

Source

https://github.com/advisories/GHSA-rqjw-p5vr-c695

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-rqjw-p5vr-c695/GHSA-rqjw-p5vr-c695.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rqjw-p5vr-c695

Aliases

CVE-2021-32770

Published

2021-07-19T15:21:41Z

Modified

2026-07-08T06:29:24Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Basic-auth app bundle credential exposure in gatsby-source-wordpress

Details

Impact

The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Example affected gatsby-config.js:

      resolve: 'gatsby-source-wordpress',
        auth: {
          htaccess: {
            username: leaked_username
            password: leaked_password,
          },
        },

Patches

A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the auth: { } section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run gatsby clean followed by a gatsby build.

Workarounds

There is no known workaround at this time, other than manually editing the app.js file post-build.

For more information

Email us at security@gatsbyjs.com

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-522"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-07-15T20:28:20Z",
    "nvd_published_at":  "2021-07-15T19:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / gatsby-source-wordpress

Package

Name: gatsby-source-wordpress; View open source insights on deps.dev
Purl: pkg:npm/gatsby-source-wordpress

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.0.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-rqjw-p5vr-c695/GHSA-rqjw-p5vr-c695.json"

npm / gatsby-source-wordpress

Package

Name: gatsby-source-wordpress; View open source insights on deps.dev
Purl: pkg:npm/gatsby-source-wordpress

Affected ranges

Type: SEMVER
Events: Introduced

5.0.0

Fixed

5.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-rqjw-p5vr-c695/GHSA-rqjw-p5vr-c695.json"