CVE-2017-16225
Github Token Leak in aegir
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
- Record
CVE-2017-16225- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
- Record
CVE-2017-16225- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2018-0238 No score
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
- Record
EUVD-2018-0238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6xhf-x49c-m5m6 No score
Github Token Leak in aegir
Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed.
Recommendation
Update to version 12.0.8 or later.
If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
- Record
GHSA-6xhf-x49c-m5m6- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user (that performed a aegir-release) GitHub token.
- Record
CVE-2017-16225- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-6xhf-x49c-m5m6 No score
Github Token Leak in aegir
Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed.
Recommendation
Update to version 12.0.8 or later.
If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
- Record
GHSA-6xhf-x49c-m5m6- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16225 is a high vulnerability (CVSS 7.5) in Aegir Project Aegir, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in aegir 12.0.8.