{"id":"CVE-2016-10526","aliases":["GHSA-rrj3-qmh8-72pf"],"url":"https://o3.security/vulnerability/CVE-2016-10526","summary":"grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file","details":"A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.","published":"2018-05-31T20:29:00.817Z","modified":"2026-10-20T10:47:20.745209455Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"grunt-gh-pages","fixedVersion":"0.10.0"}],"fix":{"url":"https://github.com/tschaub/grunt-gh-pages/pull/41","label":"tschaub/grunt-gh-pages#41"},"references":[{"type":"ADVISORY","url":"https://github.com/tschaub/grunt-gh-pages/pull/41"},{"type":"ADVISORY","url":"https://nodesecurity.io/advisories/85"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10526"},{"type":"WEB","url":"https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb"},{"type":"WEB","url":"https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342"},{"type":"PACKAGE","url":"https://github.com/tschaub/grunt-gh-pages"},{"type":"WEB","url":"https://www.npmjs.com/advisories/85"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T10:47:20.745209455Z"}}