AIKIDO-2025-10480
google-genai is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
40
Medium Risk
This Affects:
google-genaiTL;DR
Affected versions of this package are vulnerable to the exposure of API keys through URL query parameters. It occurs when sensitive keys are included in the URL query strings during API requests, which can expose them in web server logs, browser histories, or through network monitoring tools. An attacker could exploit this vulnerability by intercepting web traffic, collecting exposed URLs from public repositories or compromised logging systems, or using browser-side attacks to capture query parameters. It could lead to the theft of valid API keys, allowing unauthorized access to protected resources or impersonating legitimate users.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
google-genai is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.18.0 - 1.25.0.
How to fix this
Upgrade the google-genai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant