Sensitive Data Exposure in seneca

MEDIUM 5.3CVE-2019-5483 · GHSA-2xwv-3cc9-fp7c · Published 09/09/2019 · updated 17/06/2026

In short

CVE-2019-5483 is a MEDIUM (CVSS 5.3) vulnerability affecting seneca (senecajs), seneca.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.9% of all vulnerabilities.
Fix: update to 3.9.0 or later.

Package	Affected versions	Patched versions
seneca senecajs	`< 3.9.0`	`3.9.0`
seneca npm	`< 3.9.0`	`3.9.0`

Description

Versions of seneca prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output.

Recommendation

Upgrade to version 3.9.0 or later.

NVD description

Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.

References

nvd.nist.gov/vuln/detail/CVE-2019-5483 · ADVISORY
hackerone.com/reports/526258 · WEB
nodejs/security-wg · WEB
npmjs.com/advisories/1155 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free