{"answers":{"affected":"2 open source packages ship an affected version, including renovate.","exploited":"There is no known exploitation of CVE-2020-37267 in the wild and no public exploit code.","fix":"Upgrade renovate to 23.25.1 or later.","what":"CVE-2020-37267 is a high-severity vulnerability in renovatebot renovate, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-37267 and fix it if it is affected.\n\nWhat it is: CVE-2020-37267 is a high-severity vulnerability in renovatebot renovate, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-37267 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- renovate (npm): affected from 19.180.0; fixed in 23.25.1\n- renovate (npm): affected from 19.180.0; fixed in 23.25.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-37267/ (Markdown: https://insights.sbomify.com/CVE-2020-37267/index.md)","id":"CVE-2020-37267","markdown":"https://insights.sbomify.com/CVE-2020-37267/index.md","name":"CVE-2020-37267","record":{"aliases":["GHSA-36rh-ggpr-j3gj","GHSA-w8hm-jrh2-57j3"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Renovate dependency tool","requires_auth":"none","summary":"Attackers with log access can steal Renovate bot credentials when using Azure DevOps, potentially leading to unauthorized repository access.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"description":"Renovate versions \u003e=19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Renovate 19.180.0 before 23.25.1 Token Leakage via Logs","id":"CVE-2020-37267","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"information_disclosure","year":"2020"},"n_packages":2,"n_references":2,"next":{"headline":"Coq and Rocq Prover Print Assumptions Omits Unsafe Universe Checking Inlined Through Parameter Inline","id":"CVE-2020-37268"},"packages":[{"ecosystem":"npm","fixed":["23.25.1"],"introduced":["19.180.0"],"last_affected":[],"package":"renovate","purl":null,"source":"GHSA-36rh-ggpr-j3gj"},{"ecosystem":"npm","fixed":["23.25.1"],"introduced":["19.180.0"],"last_affected":[],"package":"renovate","purl":"pkg:npm/renovate","source":"GHSA-36rh-ggpr-j3gj"}],"prev":{"headline":"This CVE ID has been rejected.","id":"CVE-2020-37265"},"products":["renovate"],"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-19","vendors":["renovatebot"]},"summary":"Attackers with log access can steal Renovate bot credentials when using Azure DevOps, potentially leading to unauthorized repository access.","url":"https://insights.sbomify.com/CVE-2020-37267/"}