{"id":"GHSA-v7x3-7hw7-pcjg","revision":"56c9366af36e4e8badfdbf44f8b1e761","records":[{"revision":"56c9366af36e4e8badfdbf44f8b1e761","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-v7x3-7hw7-pcjg","aliases":["CVE-2019-25766"],"title":"Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments","description":"### Impact\n\nTemporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.\n\n### Patches\n\nThe problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.\n\n### Workarounds\n\nDisable Go Modules support.\n\n### References\n\nBlog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Renovate](http://github.com/renovatebot/renovate)\n","state":0,"publishedAt":"2019-10-21T16:02:33+00:00","modifiedAt":"2026-10-20T10:56:21.1761749+00:00","affected":[{"ecosystem":"npm","name":"renovate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"13.87.0"},{"kind":"fixed","version":"19.38.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg","https://github.com/advisories/GHSA-v7x3-7hw7-pcjg","https://github.com/renovatebot/renovate","https://snyk.io/vuln/SNYK-JS-RENOVATE-536203"],"sourceUrl":"https://github.com/advisories/GHSA-v7x3-7hw7-pcjg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v7x3-7hw7-pcjg","identifiers":["GHSA-v7x3-7hw7-pcjg","CVE-2019-25766"]},"retained":false,"historicalAffected":[]}],"coverage":[]}