Vulnerability · Published Feb 8, 2023 · Assigned by GitHub_M
CVE-2023-25164Sensitive Information leak via Script File in TinaCMS
High 8.6
In plain English
A high-severity sensitive data in logs in tinacms from tinacms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @tinacms/cli | 1.0.9 | GHSA-pc2q-jcxq-rjrr |
Affected products (as reported)
Weakness: CWE-532, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrr x_refsource_CONFIRM
- https://github.com/tinacms/tinacms/pull/3584 x_refsource_MISC