Executive brief
docusaurus-plugin-content-gists is a plugin for Docusaurus static site generators that integrates GitHub gists into documentation. Versions prior to 4.0.0 accidentally bundle GitHub Personal Access Tokens into publicly-viewable JavaScript files during production builds, allowing anyone accessing the website to steal the token and gain full access to the token owner's GitHub account and data.
Technical details
This is a credential exposure vulnerability (CWE-200) affecting docusaurus-plugin-content-gists versions before 4.0.0. The root cause is that the personalAccessToken configuration parameter, intended to be used only during the build process, is inadvertently included in the webpack client-side JavaScript bundle instead of being stripped before production deployment. An attacker with network access can extract the plaintext token from the published website's JavaScript files at /build/assets/js/main.[hash].js, then use it to impersonate the GitHub account with whatever permissions the token was granted. The vulnerability requires no authentication or user interaction. Version 4.0.0 and later patch this by ensuring the token is not included in the bundle.
Affected products
- npm docusaurus-plugin-content-gists < 4.0.0
Timeline
- 2025-07-09: disclosed
- 2025-07-09: patched: Version 4.0.0 released with fix