MAL-2025-21209 Malicious code in gatsby-source-fauna-id (npm)

The package gatsby-source-fauna-id was found to contain malicious code...

MAL-2025-21210 Malicious code in gatsby-source-wordpress-bcgdv (npm)

The package gatsby-source-wordpress-bcgdv was found to contain malicious code...

Malicious code in gatsby-source-fauna-id (npm)

The package gatsby-source-fauna-id was found to contain malicious code...

CVE-2021-32770

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...

MAL-2022-3286 Malicious code in gatsby-source-data-dictionary (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 609b9ce0046338f15cd270efb8914e5b4c3697afc1ac16fe9e0ac9d5ab9b2624 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatsby-source-remote-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577af0caf4e2d89635899c7917d4325d1b95c887265d00b15af3b50369437888 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3288 Malicious code in gatsby-source-remote-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577af0caf4e2d89635899c7917d4325d1b95c887265d00b15af3b50369437888 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatsby-source-newrelic-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79639755076ff66e9e9e394bf4cc78000e6aaa78d368477800acc0bff8c00361 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3287 Malicious code in gatsby-source-newrelic-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79639755076ff66e9e9e394bf4cc78000e6aaa78d368477800acc0bff8c00361 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Sensitive Data Exposure

Overview The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. Example affected...

GHSA-RQJW-P5VR-C695 Basic-auth app bundle credential exposure in gatsby-source-wordpress

Impact The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. Example affected...

@suldev/gatsby-theme-foundry (>=1.0.0 <=1.0.17) potentially affected by CVE-2021-32770 via gatsby-source-wordpress (=5.15.0)

gatsby-source-wordpress NPM version =5.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gatsby-source-wordpress and may be impacted: - @suldev/gatsby-theme-foundry =1.0.0, =1.0.17 Source cves: CVE-2021-32770 Source advisory: OSV:GHSA-RQJW-P5VR-C695...

@agileana/agileana-theme (>=0.0.1 <=0.0.3), @ajberkow/gatsby-theme-ucomm (>=0.0.1 <=0.0.8) +14 more potentially affected by CVE-2021-32770 via gatsby-source-wordpress (>=2.0.93 <=3.11.0)

gatsby-source-wordpress NPM version =2.0.93, =0.0.1, =0.0.1, =1.0.0, =1.3.1-alpha, =1.0.0, =1.0.0, =1.0.11, =1.0.26, =1.0.40, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.0.1, =0.0.4 and more Source cves: CVE-2021-32770 Source advisory: OSV:GHSA-RQJW-P5VR-C695...

Basic-auth app bundle credential exposure in gatsby-source-wordpress

Impact The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. Example affected...

CVE-2021-32770

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...

CVE-2021-32770 Basic-auth app bundle credential exposure in gatsby-source-wordpress

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...

CVE-2021-32770

The CVE-2021-32770 entry concerns the gatsby-source-wordpress plugin. Affected versions (prior to 4.0.8 and 5.9.2) leak .htaccess HTTP Basic Authentication credentials into the app.js bundle at build time. The root cause is exposure of credentials from auth.htaccess during build, which may affect...

gatsby 信息泄露漏洞

gatsby is a software application. A free open source framework based on React that helps developers build extremely fast websites and applications. A security vulnerability exists in gatsby that stems from the gatsby-source-wordpress plugin leaking .htaccess HTTP basic authentication variables in...

PT-2021-19918 · WordPress · Gatsby-Source-Wordpress

Name of the Vulnerable Software and Affected Versions: gatsby-source-wordpress versions prior to 4.0.8 and 5.9.2 Description: The gatsby-source-wordpress plugin leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. This issue affects users who initialize...