p PatchFirst

PatchFirst · Latest vulnerabilities

docusaurus-plugin-content-gists vulnerabilities

Vulnerabilities published for docusaurus-plugin-content-gists in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2025-53624

    Critical · CVSS 10EPSS 2.05%Public exploitFix available

    docusaurus-plugin-content-gists Exposes GitHub Personal Access Token

    The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.

    docusaurus-plugin-content-gistsNode.js
    • Update to 4.0.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →