Intel

AIKIDO-2024-10352

@effect/platform is vulnerable to Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Oct 22, 2024

25

Low Risk

This Affects:

js@effect/platform
0.0.0 - 0.69.5
Fixed in 0.69.6
Are you affected? Scan for Free

TL;DR

Affected versions of the package may expose sensitive information in log files by inadvertently logging it during normal operation, potentially allowing unauthorized individuals to gain access to the information.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@effect/platform is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.0 - 0.69.5.

How to fix this

Upgrade the @effect/platform library to the patch version.