AIKIDO-2026-502216
posthog-js is vulnerable to Exposure of Sensitive Information
43
CVE Score
Medium
Exposure of Sensitive Information
TL;DR
The session replay network capture feature in posthog-js redacts credential-bearing headers before storing network requests in recordings. The redaction runs only on request headers and only matches an exact deny list, so response headers such as set-cookie and credential-shaped custom header names like x-gist-encoded-user-token are captured verbatim. This places user tokens, cookies, and other secrets in plaintext inside session recordings. The fix redacts denied headers on both request and response and matches credential-shaped header names by substring.
How do I fix this?
Upgrade the posthog-js library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have session replay network header capture enabled.
Package
Versions
1.127.0 - 1.391.6
Fixed in 1.391.7Background info
posthog-js is vulnerable to Exposure of Sensitive Information in versions 1.127.0 - 1.391.6.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.