docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

Description

No description available.

Recommendation

Update the docusaurus-plugin-content-gists package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.0.0
• Patched version(s): 4.0.0

References

• GHSA-qf34-qpr4-5pph
• CVE-2025-53624
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE - CVE-2025-55164
• @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
• Suspended Directus user can continue to use session token to access API - CVE-2025-30351
• Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler - CVE-2025-27098

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

docusaurus-plugin-content-gists