CVE-2017-16225: Github Token Leak in aegir
Summary
CVE-2017-16225: Github Token Leak in aegir. Affects aegir versions >= 12.0.0, < 12.0.8. Fixed in 12.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aegir package is an npm module used for bundling and publishing projects. It provides functionality to release projects to GitHub using GitHub tokens. However, versions of aegir prior to 12.0.8 have a vulnerability that leaks the current user's GitHub token to npm when executing the aegir-release command.
Vulnerability Detail
The vulnerability in aegir allows an attacker to obtain the GitHub token of the user executing the aegir-release command. This token can be used by the attacker to gain unauthorized access to the user's GitHub account and perform malicious actions. The vulnerability affects versions of aegir up to and including 12.0.7.
How To Fix
Latest published version: 48.1.6 as of 22 Oct 2026
npm install aegir@48.1.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.8
This is the first release that contains the fix.
npm install aegir@12.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The aegir package has a vulnerability that leaks the user's GitHub token when executing the aegir-release command. To fix the vulnerability, update to version 12.0.8 or later and invalidate any leaked tokens. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for aegir →
FAQ
The vulnerability allows an attacker to obtain the GitHub token of the user executing the aegir-release command. This token can be used to gain unauthorized access to the user's GitHub account and perform malicious actions.
Versions of aegir up to and including 12.0.7 are affected by this vulnerability.
To fix the vulnerability, update to version 12.0.8 or later of the aegir package and invalidate any leaked GitHub tokens.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-6xhf-x49c-m5m6/GHSA-6xhf-x49c-m5m6.json
Related vulnerabilities
Recent vulnerabilities recorded for aegir.
