Basic-auth app bundle credential exposure in gatsby-source-wordpress

Description

The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Recommendation

Update the gatsby-source-wordpress package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.9.2

  < 4.0.8**

• Patched version(s): **5.9.2

  4.0.8**

References

• GHSA-rqjw-p5vr-c695
• CVE-2021-32770
• CWE-200
• CWE-522
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Marp Core allows XSS by improper neutralization of HTML sanitization - CVE-2024-56510
• bootstrap Cross-site Scripting vulnerability (GHSA-ph58-4vrj-w6hr) 2 - CVE-2018-20677

Tags:

npm

gatsby-source-wordpress