CVE-2019-25766
Renovate before 19.38.7 Credential Exposure via Go Modules
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 19, 2026
- Updated
- Aug 25, 2026
- Reserved
- Aug 19, 2026
Description
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
renovaterenovatebot |
|
References
- GitHub Security Advisory (GHSA-v7x3-7hw7-pcjg)vendor-advisory
- VulnCheck Advisory: Renovate before 19.38.7 Credential Exposure via Go Modulesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.