CVE-2019-25766

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in renovate 19.38.7.

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-532
Published: 2026-08-19
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v7x3-7hw7-pcjg	npm	renovate	>=13.87.0 <19.38.7	19.38.7

References

https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules

Check your stack JSON