PT-2025-28964 · Unknown · Docusaurus-Plugin-Content-Gists

Webbertakken · Published 2025-07-09 · Updated 2025-07-14 · CVE-2025-53624

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: docusaurus-plugin-content-gists versions prior to 4.0.0

Description: The Docusaurus gists plugin displays public gists of a GitHub user on a Docusaurus instance. Versions prior to 4.0.0 inadvertently include GitHub Personal Access Tokens in client-side JavaScript bundles when passed through plugin configuration options. These tokens, intended for build-time API access, become accessible to anyone who can view the website's source code.

Recommendations: Update docusaurus-plugin-content-gists to version 4.0.0.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-53624

GHSA-QF34-QPR4-5PPH

Affected Products

Docusaurus-Plugin-Content-Gists

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53624.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53624 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53624 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qf34-qpr4-5pph · Vendor Advisory
• https://github.com/webbertakken/docusaurus-plugin-content-gists/commit/8d4230b82412edb215ddfa9e609d178510a5fe31 · Note
• https://github.com/webbertakken/docusaurus-plugin-content-gists · Note
• https://github.com/webbertakken/docusaurus-plugin-content-gists/security/advisories/GHSA-qf34-qpr4-5pph · Note
• https://twitter.com/VulmonFeeds/status/1943161954375180799 · Twitter Post
• https://twitter.com/offseq/status/1943097930400801073 · Twitter Post
• https://twitter.com/CveFindCom/status/1943062767046434908 · Twitter Post
• https://twitter.com/CVEnew/status/1943335890937393644 · Twitter Post
• https://twitter.com/cracbot/status/1944713566738911503 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1943490439551816134 · Twitter Post