github.com
https://github.com/webbertakken/docusaurus-plugin-content-gists CVE-2025-53624
CRITICALNuclei
docusaurus-plugin-content-gists Exposes GitHub Personal Access Token
Record summary
CVE-2025-53624 has a selected CVSS score of 10.0 (critical); EIP currently links 1 Nuclei template.
Description
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 10, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
docusaurus-plugin-content-gistsBrowse webbertakken / docusaurus-plugin-content-gists | CVE List | < 4.0.0 | affected |
docusaurus-plugin-content-gistsBrowse npm / docusaurus-plugin-content-gists | GitHub Advisory | Before 4.0.0 · Fixed in 4.0.0 | affected |
Nuclei templates
1ProjectDiscoveryHIGHDocusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token ExposureCVSS 8.6
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code.
Impact
A GitHub personal access token exposure vulnerability can grant an attacker unauthorized access to your repositories and organization resources, potentially leading to data exfiltration, code injection, and supply chain attacks.
Remediation
Update docusaurus-plugin-content-gists to version 4.0.0+. Revoke access to the GitHub PAT that was used: https://github.com/settings/tokens.
WeaknessesCWE-200
Authorsdarses
Template tagscvecve2025docusaurusexposurevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Shodan: http.html:"Docusaurus"
FOFA: body="Docusaurus"
https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31 https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph https://nvd.nist.gov/vuln/detail/CVE-2025-53624
Source: ProjectDiscovery
References
4github.com
https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31 github.comConfirmation
https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-53624