{"cve":"CVE-2024-39314","nvd":{"published":"2024-07-01T22:15:03.900","modified":"2026-06-17T07:41:41.840","status":"Deferred","description":"toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":4.7},"cwes":["CWE-200","CWE-214"],"references":["https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7","https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89","https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7","https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:52:00.836172422+00:00"},"epss":{"cve":"CVE-2024-39314","score":0.0019,"percentile":0.08673,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}