@nuxtlabs/github-module made Use of Hard-coded Credentials

CRITICAL 9.8CVE-2023-2138 · GHSA-fp2w-g92g-fgq4 · Published 18/04/2023 · updated 17/06/2026

In short

CVE-2023-2138 is a CRITICAL (CVSS 9.8) vulnerability affecting nuxt (nuxtlabs), @nuxtlabs/github-module.
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 54.9% of all vulnerabilities.
Fix: update to 1.6.2 or later.

Package	Affected versions	Patched versions
nuxt nuxtlabs	`< 1.6.2`	`1.6.2`
@nuxtlabs/github-module npm	`< 1.6.2`	`1.6.2`

Description

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue.

NVD description

Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.

References

nvd.nist.gov/vuln/detail/CVE-2023-2138 · ADVISORY
nuxtlabs/github-module commit 5490c43 · WEB
nuxtlabs/github-module · PACKAGE
nuxtlabs/github-module release v1.6.2 · WEB
huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free