Versions of grunt-gh-pages
prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.
In the grunt-gh-pages
deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, grunt-gh-pages
will write the token to a log file, unencrypted.
Update to version 0.10.0 or later.
{ "github_reviewed_at": "2020-06-16T21:55:45Z", "cwe_ids": [ "CWE-391" ], "nvd_published_at": null, "severity": "MODERATE", "github_reviewed": true }