Executive brief
A Nuxt.js module for GitHub integration contained a hard-coded GitHub authentication token in its public source code. An attacker who discovered this token could gain unauthorized access to multiple GitHub repositories belonging to the Nuxt organizations, potentially leading to code injection, data theft, or service disruption. The vulnerability affected all versions prior to 1.6.2.
Technical details
The @nuxtlabs/github-module library exposed a hard-coded GitHub personal access token in its public-facing source code, representing a credential disclosure vulnerability (CWE-798). The token was embedded in the module configuration and exposed through the public runtime config, making it trivially discoverable by anyone reviewing the source code or inspecting client-side assets. An attacker possessing this token could authenticate to GitHub and access repositories under the nuxt, nuxtlabs, and nuxt-themes organizations. No authentication or user interaction is required; discovery is passive and exploitation is network-accessible. The issue was patched in version 1.6.2 by removing the token from public runtime configuration and refactoring to avoid setting it in the first place.
Affected products
- NuxtLabs github-module all versions before 1.6.2
Timeline
- 2023-04-18: disclosed: Published to OSV/GitHub Advisory Database
- 2023-04-18: patched: Fixed in version 1.6.2