CVE-2025-53624 docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
An attacker can view the website's source code to steal GitHub Personal Access Tokens exposed in client-side JavaScript bundles by the Docusaurus gists plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53624?
CVE-2025-53624 is a critical vulnerability in webbertakken docusaurus-plugin-content-gists, published on 9 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.
Weakness: CWE-200
Which versions are affected by CVE-2025-53624?
2 open source packages ship an affected version, including docusaurus-plugin-content-gists.
| Package | Affected | Fixed in |
|---|---|---|
docusaurus-plugin-content-gists npm | All versions | 4.0.0 |
docusaurus-plugin-content-gists npm | All versions | 4.0.0 |
How do I fix CVE-2025-53624?
Upgrade docusaurus-plugin-content-gists to 4.0.0 or later.
Is CVE-2025-53624 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53624 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-qf34-qpr4-5pph.