CVE-2016-10526
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
- Record
CVE-2016-10526- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-391, CWE-255, CWE-532
- Updated
- 2026-11-02
CVE List No score
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
- Record
CVE-2016-10526- Weakness
- CWE-391
- Updated
- 2026-11-02
EUVDEUVD-2019-0342 No score
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
- Record
EUVD-2019-0342- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rrj3-qmh8-72pf No score
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
Versions of grunt-gh-pages prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.
In the grunt-gh-pages deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, grunt-gh-pages will write the token to a log file, unencrypted.
Recommendation
Update to version 0.10.0 or later.
- Record
GHSA-rrj3-qmh8-72pf- Weakness
- CWE-391
- Updated
- 2026-11-02
OSV
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
- Record
CVE-2016-10526- CVSS 3.0
- 8.6 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-rrj3-qmh8-72pf No score
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
Versions of grunt-gh-pages prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.
In the grunt-gh-pages deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, grunt-gh-pages will write the token to a log file, unencrypted.
Recommendation
Update to version 0.10.0 or later.
- Record
GHSA-rrj3-qmh8-72pf- Weakness
- CWE-391
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
grunt-gh-pagesnpm |
through 0.9.1 | 0.10.0 |
grunt-gh-pagesnpm |
before 0.10.0 | 0.10.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10526 is a high vulnerability (CVSS 8.6) in Grunt-gh-pages Project Grunt-gh-pages, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in grunt-gh-pages 0.10.0.
References
github.com/tschaub/grunt-gh-pages/pull/41
nodesecurity.io/advisories/85
nvd.nist.gov/vuln/detail/CVE-2016-10526
npmjs.com/advisories/85