CyberRota Analysis
AI-GeneratedVersions of Renovate from 13.87.0 to 19.38.6 are vulnerable to a token leakage issue, where temporary repository tokens are exposed in pull request comments during specific Go Modules update failures. This vulnerability allows unauthorized users to access sensitive tokens, potentially compromising repository security. Organizations using affected Renovate versions should prioritize upgrading to version 19.38.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.