| Package | Affected versions | Patched versions |
|---|---|---|
| grunt-gh-pages | < 0.9.1 | 0.9.1 |
| grunt-gh-pages | < 0.10.0 | 0.10.0 |
Versions of grunt-gh-pages prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.
In the grunt-gh-pages deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, grunt-gh-pages will write the token to a log file, unencrypted.
Update to version 0.10.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free