Sensitive Information Exposure in GH R Package - Version 1.1.0 to 1.4.9
Summary
RSEC-2025-0: Arbitrary Code Execution (ACE) Vulnerability. Affects gh versions >= 1.1.0, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GH R package is a widely used tool for interacting with the GitHub API, allowing users to perform operations such as fetching repositories, managing issues, and handling pull requests. It is designed to simplify the integration of R with GitHub services, making it easier for developers and data scientists to automate workflows. However, prior to version 1.5.0, the package contained a vulnerability that could lead to the exposure of sensitive information.
Vulnerability Detail
A bug was identified in releases of the GH R package prior to version 1.5. This flaw could expose sensitive information, such as authentication tokens, through request headers during its operation if responses were cached to disk. This vulnerability poses a significant risk as it could allow unauthorized access to sensitive data, potentially compromising user accounts and security.
How To Fix
Minimum fixed version
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid caching responses to disk by configuring their application to not store any sensitive information in request headers. This may involve modifying the caching settings or using alternative methods to handle API responses.
Conclusion
In summary, the GH R package had a vulnerability that could expose sensitive information in versions prior to 1.5.0. Users are strongly encouraged to update to the latest version to mitigate risks. For those unable to update immediately, implementing workarounds can help reduce exposure until a proper update can be performed.
See every vulnerability recorded for gh →
FAQ
Versions 1.1.0 to 1.4.9 of the GH R package are affected by this vulnerability.
The vulnerability could expose sensitive information such as authentication tokens through request headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Updating to the patched version (1.5.0 or later) is the best way to prevent exploitation. Additionally, avoid caching sensitive information.
If you cannot update the package immediately, consider implementing workarounds such as avoiding caching sensitive information in request headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for gh.
