GHSA-6r78-m64m-qwcf Moq v4.20.0-rc to 4.20.1 share hashed user data
Moq library versions leaked hashed user email addresses to remote servers during build time without user consent or disable option.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6r78-m64m-qwcf?
GHSA-6r78-m64m-qwcf is a vulnerability in moq, published on 10 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.
Moq v4.20.2 has removed this functionality.
Which versions are affected by GHSA-6r78-m64m-qwcf?
2 open source packages ship an affected version, including moq.
| Package | Affected | Fixed in |
|---|---|---|
moq NuGet | From 4.20.0-rc | 4.20.2 |
moq NuGet | From 4.20.0-rc | 4.20.2 |
How do I fix GHSA-6r78-m64m-qwcf?
Upgrade moq to 4.20.2 or later.
Is GHSA-6r78-m64m-qwcf being exploited?
There is no known exploitation of GHSA-6r78-m64m-qwcf in the wild and no public exploit code.