CVE-2019-25766CWE-532

CVE-2019-25766

High · published August 19, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
36.4
In the wild
Unconfirmed
What it is

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00432 · 36.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-08-19T18:17Z
References (2)
https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg · [email protected]https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules · [email protected]
EPSS history
Timeline
  • 19 AUG 14:01Z
    Renovate before 19.38.7 Credential Exposure via Go Modules
    cvelistv5