GHSA-6r78-m64m-qwcf
Moq v4.20.0-rc to 4.20.1 share hashed user data
GHSA-6r78-m64m-qwcf is a vulnerability with no CVSS score yet in moq, published August 10, 2023. No source lists public exploit code. Fixed in moq 4.20.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.20.2moq +1 more
Description
Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.
Moq v4.20.2 has removed this functionality.
Affected packages
What each source reports
GitHub AdvisoriesNo score
Moq v4.20.0-rc to 4.20.1 share hashed user data
Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.
Moq v4.20.2 has removed this functionality.
- Record
GHSA-6r78-m64m-qwcf- Updated
- 2026-11-02
OSVNo score
Moq v4.20.0-rc to 4.20.1 share hashed user data
Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.
Moq v4.20.2 has removed this functionality.
- Record
GHSA-6r78-m64m-qwcf- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.