{"id":"GHSA-36rh-ggpr-j3gj","revision":"d016e7d82f5841ed9c6477496304bc38","records":[{"revision":"d016e7d82f5841ed9c6477496304bc38","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-36rh-ggpr-j3gj","aliases":["CVE-2020-37267"],"title":"Renovate vulnerable to Azure DevOps token leakage in logs","description":"### Impact\n\nApplies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the `http.extraheader=AUTHORIZATION` parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.\n\n### Patches\n\nFixed in \n\n### Workarounds\n\nDo not share Renovate logs with anyone who cannot be trusted with access to the token.\n","state":0,"publishedAt":"2020-09-14T16:38:40+00:00","modifiedAt":"2026-10-20T10:56:21.3855673+00:00","affected":[{"ecosystem":"npm","name":"renovate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.180.0"},{"kind":"fixed","version":"23.25.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj","https://github.com/renovatebot/renovate"],"sourceUrl":"https://github.com/advisories/GHSA-36rh-ggpr-j3gj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-36rh-ggpr-j3gj","identifiers":["GHSA-36rh-ggpr-j3gj","CVE-2020-37267"]},"retained":false,"historicalAffected":[]}],"coverage":[]}