Information Exposure Affecting @tinacms/cli package, versions >=1.0.0 <1.0.9
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-TINACMSCLI-3317170
- published 9 Feb 2023
- disclosed 9 Feb 2023
- credit Unknown
Introduced: 9 Feb 2023
CVE-2023-25164 Open this link in a new tabHow to fix?
Upgrade @tinacms/cli to version 1.0.9 or higher.
Overview
@tinacms/cli is a The Tina Cloud CLI can be used to set up your project with Tina Cloud configuration, and run a local version of the Tina Cloud content-api (using your file system's content). For a real-world example of how this is being used checkout the [Tina Cloud St
Affected versions of this package are vulnerable to Information Exposure when storing sensitive values in the process.env variable. These values will be added in plaintext to the index.js file.
Impact
Users who are affected (eg. Algolia API keys) should rotate the keys immediately.