CVE-2019-25766
HighCVSS 7.5Summary
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Risk Assessment
The risk includes exposure of repository access tokens, potentially leading to unauthorized access to source code.
Recommendation
Upgrade Renovate to version 19.38.7 or later and rotate tokens if they may have been exposed.
Original NVD description (English source)
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.