AIKIDO-2026-502216
posthog-js is vulnerable to Exposure of Sensitive Information
43
Medium Risk
This Affects:
posthog-jsTL;DR
The session replay network capture feature in posthog-js redacts credential-bearing headers before storing network requests in recordings. The redaction runs only on request headers and only matches an exact deny list, so response headers such as set-cookie and credential-shaped custom header names like x-gist-encoded-user-token are captured verbatim. This places user tokens, cookies, and other secrets in plaintext inside session recordings. The fix redacts denied headers on both request and response and matches credential-shaped header names by substring.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have session replay network header capture enabled.
Background info
posthog-js is vulnerable to Exposure of Sensitive Information in versions 1.127.0 - 1.391.6.
How to fix this
Upgrade the posthog-js library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant