Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| docusaurus-plugin-content-gists | npm | < 4.0.0 | 4.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a critical information exposure where a GitHub Personal Access Token (PAT), provided in the plugin configuration, is included in the final JavaScript build artifacts, making it publicly accessible. The root cause lies in the plugin's failure to separate build-time secrets from client-side runtime configuration.
The analysis of the patch commit 8d4230b82412edb215ddfa9e609d178510a5fe31 reveals two key functions involved in this process:
gists (in src/index.ts): This is the main plugin function. In vulnerable versions, it directly accepted the personalAccessToken from its options parameter. This options object was then implicitly available to the webpack bundling process, causing the token to be leaked into the client-side code. The patch corrects this by sourcing the token from a build-time environment variable (process.env.GH_PERSONAL_ACCESS_TOKEN) and creating a sanitized runtimeOptions object that is safe to use for client-side configuration.
validateOptions (in src/validateOptions.ts): This function validates the plugin's configuration. Before the patch, it included a schema rule to require the personalAccessToken, thereby legitimizing its presence in the configuration that would later be mishandled by the gists function. The patch removes this validation rule and adds a check to explicitly fail the build if personalAccessToken is still present in the configuration, forcing users to migrate to the more secure environment variable method.
Both functions are part of the Node.js build process of the Docusaurus site. The vulnerability is triggered during the build (docusaurus build) when a vulnerable version of the plugin is used with the token in its configuration. The exploitation consists of inspecting the generated JavaScript files of the built website.
