{"id":"CVE-2016-10526","aliases":["EUVD-2019-0342","GHSA-rrj3-qmh8-72pf"],"status":"published","title":"grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file","description":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions \u003c 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01612,"percentile":0.76101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-255","CWE-391","CWE-532"],"published":"2018-05-31T20:00:00Z","modified":"2026-10-20T10:47:20Z","fixes":[{"ecosystem":"npm","package":"grunt-gh-pages","fixed_in":["0.10.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"grunt-gh-pages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.1"},{"fixed":"0.10.0"}]}]},{"source":"osv","ecosystem":"npm","package":"grunt-gh-pages","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.0"}]}]}],"products":[{"vendor":"grunt-gh-pages_project","product":"grunt-gh-pages"},{"vendor":"hackerone","product":"grunt-gh-pages node module"}],"references":[{"url":"https://github.com/tschaub/grunt-gh-pages/pull/41","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nodesecurity.io/advisories/85","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10526","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/85","tags":["web"]},{"url":"https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb","tags":["web"]},{"url":"https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rrj3-qmh8-72pf"},{"url":"https://github.com/tschaub/grunt-gh-pages","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-10526","description":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions \u003c 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-16T20:37:56.998Z","cwes":["CWE-391"],"updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2019-0342","description":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions \u003c 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-16T20:37:56Z","updated_at":"2026-11-03T00:55:12.113193Z"}],"ghsa":[{"id":"GHSA-rrj3-qmh8-72pf","title":"grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file","description":"Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.\n\nIn the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.\n\n\n## Recommendation\n\nUpdate to version 0.10.0 or later.","status":"published","published":"2019-02-18T23:39:11Z","modified":"2023-01-11T05:08:04Z","cwes":["CWE-391"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"nvd":[{"id":"CVE-2016-10526","description":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions \u003c 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","status":"published","published":"2018-05-31T20:29:00.817Z","modified":"2026-06-17T00:39:52.74Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-391","CWE-255","CWE-532"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"CVE-2016-10526","description":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions \u003c 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","status":"published","published":"2018-05-31T20:29:00.817Z","modified":"2026-10-20T10:47:20.745209455Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"GHSA-rrj3-qmh8-72pf","title":"grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file","description":"Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.\n\nIn the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.\n\n\n## Recommendation\n\nUpdate to version 0.10.0 or later.","status":"published","published":"2019-02-18T23:39:11Z","modified":"2023-11-08T03:58:10.599145Z","cwes":["CWE-391"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}