Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2016-10526

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2016-10526
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 09:38 UTC · Revision 1

Source evidence

CVE-2016-10526

core-osv · Original source

Published 31 May 2018, 20:29 UTC

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.

osv:CVE-2016-10526
Complete source record
{
  "id": "b83e8b1b901df6599ebd68061c9ec5d53eb83be2093c4b7faaa90113062ad9a9",
  "url": "https://osv.dev/vulnerability/CVE-2016-10526",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2016-10526",
    "summary": "A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.",
    "evidence": "osv:CVE-2016-10526",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2016-10526",
      "aliases": [
        "CVE-2016-10526",
        "GHSA-rrj3-qmh8-72pf"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/tschaub/grunt-gh-pages",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "04a5b857f91b0ad5a328bb6dc76f69e89de5c6cb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:grunt-gh-pages_project:grunt-gh-pages:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.9.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.8.1",
            "v0.8.0",
            "v0.7.6",
            "v0.7.5",
            "v0.7.4",
            "v0.7.3",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.0",
            "v0.5.1",
            "v0.5.0",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10526.json"
          }
        }
      ],
      "modified": "2026-10-20T10:47:20.745209455Z",
      "provider": "osv",
      "references": [
        "https://github.com/tschaub/grunt-gh-pages/pull/41",
        "https://nodesecurity.io/advisories/85"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2016-10526",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 379362,
  "published_at": "2018-05-31T20:29:00.817+00:00"
}