CVE-2019-25766
Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
- Record
CVE-2019-25766- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2019-20202
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
- Record
EUVD-2019-20202- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3r27-cgcx-x497
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request...
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
- Record
GHSA-3r27-cgcx-x497- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v7x3-7hw7-pcjg
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Impact
Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.
Patches
The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.
Workarounds
Disable Go Modules support.
References
Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure
For more information
If you have any questions or comments about this advisory:
- Open an issue in Renovate
- Record
GHSA-v7x3-7hw7-pcjg- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
- Record
CVE-2019-25766- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
- Record
CVE-2019-25766- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVGHSA-v7x3-7hw7-pcjg
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Impact
Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.
Patches
The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.
Workarounds
Disable Go Modules support.
References
Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure
For more information
If you have any questions or comments about this advisory:
- Open an issue in Renovate
- Record
GHSA-v7x3-7hw7-pcjg- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
renovatenpm |
13.87.0 up to 19.38.7 | 19.38.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-25766 is a high vulnerability (CVSS 8.7) in Renovatebot Renovate, published October 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in renovate 19.38.7.
References
github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules
nvd.nist.gov/vuln/detail/CVE-2019-25766
snyk.io/vuln/SNYK-JS-RENOVATE-536203