Headline

GHSA-qf34-qpr4-5pph: docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

GitHub Personal Access Token Exposure in docusaurus-plugin-content-gists

Summary

docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website’s source code.

Affected Versions

All versions < 4.0.0

Patched Versions

Version 4.0.0 and later

Impact

When using the affected versions with the recommended configuration pattern:

plugins: [
  [
    'docusaurus-plugin-content-gists',
    {
      personalAccessToken: process.env.GITHUB_PERSONAL_ACCESS_TOKEN,
    },
  ],
]

The GitHub Personal Access Token is included in the webpack bundle and exposed in production builds at:

/build/assets/js/main.[hash].js

This allows malicious actors to:

Extract the GitHub Personal Access Token from the website’s JavaScript files
Use the stolen token to access the token owner’s GitHub account with the granted permissions
Potentially access private gists, repositories, or perform other actions depending on the token’s scope

Mitigation steps

Immediately revoke access to the GitHub PAT that was used: https://github.com/settings/tokens

Migration steps

Update to version 4.0.0+: npm install docusaurus-plugin-content-gists@^4.0.0
Remove personalAccessToken from your plugin configuration
Ensure GH_PERSONAL_ACCESS_TOKEN is set in your build environment

9 hours ago

ghsa

Open in Source

#vulnerability #web #nodejs #js #git #java

GitHub Personal Access Token Exposure in docusaurus-plugin-content-gists****Summary

Affected Versions

All versions < 4.0.0

Patched Versions

Version 4.0.0 and later

Impact

When using the affected versions with the recommended configuration pattern:

plugins: [ [ 'docusaurus-plugin-content-gists’, { personalAccessToken: process.env.GITHUB_PERSONAL_ACCESS_TOKEN, }, ], ]

The GitHub Personal Access Token is included in the webpack bundle and exposed in production builds at:

/build/assets/js/main.[hash].js

This allows malicious actors to:

Extract the GitHub Personal Access Token from the website’s JavaScript files
Use the stolen token to access the token owner’s GitHub account with the granted permissions
Potentially access private gists, repositories, or perform other actions depending on the token’s scope

Mitigation steps