{"answers":{"affected":"4 open source packages ship an affected version, including org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli and org.hl7.fhir.publisher:org.hl7.fhir.publisher.core.","exploited":"There is no known exploitation of CVE-2025-24363 in the wild and no public exploit code.","fix":"Upgrade org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli to 1.8.9 or later.","what":"CVE-2025-24363 is a medium-severity vulnerability in HL7 fhir-ig-publisher, published on 24 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2025-24363 and fix it if it is affected.\n\nWhat it is: CVE-2025-24363 is a medium-severity vulnerability in HL7 fhir-ig-publisher, published on 24 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2025-24363 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (Maven): affected all versions; fixed in 1.8.9\n- org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (Maven): affected all versions; fixed in 1.8.9\n- org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (Maven): affected all versions; fixed in 1.8.9\n- org.hl7.fhir.publisher:org.hl7.fhir.publisher.core (Maven): affected all versions; fixed in 1.8.9\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-24363/ (Markdown: https://insights.sbomify.com/CVE-2025-24363/index.md)","id":"CVE-2025-24363","markdown":"https://insights.sbomify.com/CVE-2025-24363/index.md","name":"CVE-2025-24363","record":{"aliases":["GHSA-6729-95v3-pjc2"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"HL7 FHIR IG Publisher","requires_auth":"high_privilege","summary":"The HL7 FHIR IG Publisher may expose GitHub credentials in built Implementation Guides when using credential-based repository URLs in CI contexts.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":4.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses git commands to determine the URL of the originating repo. If the repo was cloned, or otherwise set to use a repo that uses a username and credential based URL, the entire URL will be included in the built Implementation Guide, exposing username and credential. This does not impact users that clone public repos without credentials, such as those using the auto-ig-build continuous integration infrastructure. This problem has been patched in release 1.8.9. Some workarounds are available. Users should ensure the IG repo they are publishing does not have username or credentials included in the `origin` URL. Running the command `git remote origin url` should return a URL that contains no username, password, or token; or users should run the IG Publisher CLI with the `-repo` parameter and specify a URL that contains no username, password, or token.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"The HL7 FHIR IG publisher may potentially expose GitHub repo user and credential information","id":"CVE-2025-24363","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":4,"n_references":3,"next":{"headline":"vaultwarden allows RCE in the admin panel","id":"CVE-2025-24364"},"packages":[{"ecosystem":"Maven","fixed":["1.8.9"],"introduced":["0"],"last_affected":[],"package":"org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli","purl":null,"source":"GHSA-6729-95v3-pjc2"},{"ecosystem":"Maven","fixed":["1.8.9"],"introduced":["0"],"last_affected":[],"package":"org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli","purl":"pkg:maven/org.hl7.fhir.publisher/org.hl7.fhir.publisher.cli","source":"GHSA-6729-95v3-pjc2"},{"ecosystem":"Maven","fixed":["1.8.9"],"introduced":["0"],"last_affected":[],"package":"org.hl7.fhir.publisher:org.hl7.fhir.publisher.core","purl":null,"source":"GHSA-6729-95v3-pjc2"},{"ecosystem":"Maven","fixed":["1.8.9"],"introduced":["0"],"last_affected":[],"package":"org.hl7.fhir.publisher:org.hl7.fhir.publisher.core","purl":"pkg:maven/org.hl7.fhir.publisher/org.hl7.fhir.publisher.core","source":"GHSA-6729-95v3-pjc2"}],"prev":{"headline":"CodeQL GitHub Action failed workflow writes GitHub PAT to debug artifacts","id":"CVE-2025-24362"},"products":["fhir-ig-publisher"],"published":"2025-01-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-01-24","vendors":["HL7"]},"summary":"The HL7 FHIR IG Publisher may expose GitHub credentials in built Implementation Guides when using credential-based repository URLs in CI contexts.","url":"https://insights.sbomify.com/CVE-2025-24363/"}