CVE-2020-11059: Sensitive Information Exposure in AEgir
Summary
CVE-2020-11059: Exposure of Sensitive Information to an Unauthorized Actor in AEgir. Affects aegir versions >= 21.7.0, < 21.10.1. Fixed in 21.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AEgir is an open-source tool used for publishing and building browser bundles. It is commonly used in the npm ecosystem. The tool allows users to publish and build bundles, but it has been found to have a vulnerability that can lead to the exposure of sensitive information.
Vulnerability Detail
The vulnerability in AEgir, identified as CVE-2020-11059, allows an unauthorized actor to access sensitive information from environmental variables in the browser bundle published to npm. This can lead to the leakage of secrets and potentially compromise the security of the application. The vulnerability has a CVSS score of 9.6, indicating its critical severity.
How To Fix
Latest published version: 48.1.6 as of 22 Oct 2026
npm install aegir@48.1.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.10.1
This is the first release that contains the fix.
npm install aegir@21.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can run the command 'printenv' to check their environment variables and revoke any secrets that may have been exposed. This will help mitigate the risk of unauthorized access to sensitive information.
Conclusion
In conclusion, CVE-2020-11059 is a critical vulnerability in AEgir that allows the exposure of sensitive information. Users should upgrade to the latest version of AEgir (21.10.1 or higher) to mitigate this vulnerability. As a temporary workaround, users can revoke any exposed secrets by running the 'printenv' command. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aegir →
FAQ
AEgir is an open-source tool used for publishing and building browser bundles in the npm ecosystem.
The vulnerability allows an unauthorized actor to access sensitive information from environmental variables, potentially leading to the exposure of secrets and compromising the security of the application.
To fix this vulnerability, upgrade to AEgir version 21.10.1 or higher, which includes the necessary patches to prevent the exposure of sensitive information.
As a temporary workaround, users can run the command 'printenv' to check their environment variables and revoke any exposed secrets.
For more information, you can open an issue in the aegir GitHub repository: https://github.com/ipfs/aegir
References
Related vulnerabilities
Recent vulnerabilities recorded for aegir.
