AIKIDO-2026-10247
@convex-dev/polar is vulnerable to Insertion of Sensitive Information into Log File
10
Low Risk
This Affects:
@convex-dev/polarTL;DR
Affected versions of this package are vulnerable to sensitive information exposure due to improper error handling that may leak confidential data through application logs. When SDK operations fail, raw error or response objects containing authentication tokens and other sensitive information can be propagated or logged without sanitization. This can allow attackers with access to logs to obtain credentials or internal data. The issue is fixed by ensuring sensitive values from SDK responses are no longer exposed during error handling.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@convex-dev/polar is vulnerable to Insertion of Sensitive Information into Log File in versions 0.6.3 - 0.8.0.
How to fix this
Upgrade the @convex-dev/polar library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant