{"answers":{"affected":"2 open source packages ship an affected version, including hubuum_client.","exploited":"There is no known exploitation of GHSA-2625-rw7m-5q5x in the wild and no public exploit code.","fix":"Upgrade hubuum_client to 0.6.1 or later.","what":"GHSA-2625-rw7m-5q5x is a vulnerability in hubuum_client, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-2625-rw7m-5q5x and fix it if it is affected.\n\nWhat it is: GHSA-2625-rw7m-5q5x is a vulnerability in hubuum_client, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-2625-rw7m-5q5x in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- hubuum_client (crates.io): affected all versions; fixed in 0.6.1\n- hubuum_client (crates.io): affected all versions; fixed in 0.6.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/ (Markdown: https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/index.md)","id":"GHSA-2625-rw7m-5q5x","markdown":"https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/index.md","name":"GHSA-2625-rw7m-5q5x","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust client library","requires_auth":"none","summary":"Attackers can access sensitive data like tokens and payloads via logs because the Hubuum client library exposes them in default error diagnostics.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\n`hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models.\n\n## Affected behavior\n\nNative `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted`, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains.\n\nSeveral public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level backup and export runners additionally copied unsuccessful server task summaries into `ApiError::Api`.\n\nApplications commonly log errors and response values, so credentials, tokens, cursors, filters, echoed request content, imported object data, schema defaults, task or delivery details, and other sensitive payloads can be written to logs even though normal request logging redacts query values.\n\n## Remediation\n\nThe proposed fix redacts query values from embedded request URLs before storing native HTTP errors and applies the same sanitization to exhausted retries. Default error and model diagnostics now report safe metadata rather than server messages, payloads, cursors, links, configuration, or secret-adjacent details. JSON codec errors no longer appear in the standard source chain, and unsuccessful high-level backup/export operations use the structured `TaskUnsuccessful` variant without copying task summaries.\n\nExplicit response, error, task, import, export, event, and delivery APIs continue to expose original values for applications that deliberately inspect them.\n\n## Validation\n\nRegression coverage exercises direct HTTP conversion, async and blocking retry exhaustion, response and decoding diagnostics, import/export/raw-response containers, unsuccessful async and blocking task runners, task/event/import-result models, and secret-bearing event and remote models. The workspace format, lint, documentation, test, feature-matrix, Rust 1.88 MSRV, OpenAPI validation, release-metadata, and combined library plus consumer integration suites pass against the immutable Hubuum 0.0.3 image.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics","id":"GHSA-2625-rw7m-5q5x","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.6.1"],"introduced":["0"],"last_affected":[],"package":"hubuum_client","purl":null,"source":"GHSA-2625-rw7m-5q5x"},{"ecosystem":"crates.io","fixed":["0.6.1"],"introduced":["0"],"last_affected":[],"package":"hubuum_client","purl":"pkg:cargo/hubuum_client","source":"GHSA-2625-rw7m-5q5x"}],"products":null,"published":"2026-07-24","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can access sensitive data like tokens and payloads via logs because the Hubuum client library exposes them in default error diagnostics.","url":"https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/"}