AIKIDO-2026-805853
builder-util-runtime is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
82
High Risk
This Affects:
builder-util-runtimeTL;DR
The HTTP redirect handler in builder-util-runtime strips a credential header only when its key exactly matches the lowercase string authorization. Credential headers with other names or casing, such as PRIVATE-TOKEN and mixed-case Authorization, are not removed and are forwarded when a request follows a cross-origin redirect. During an authenticated updater flow the credentials reach the redirect destination, so an attacker who controls or can observe that destination receives them intact. The fix strips all known sensitive headers using a case-insensitive, separator-agnostic match on cross-origin redirects.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses an authenticated updater provider that sends credentials in a header other than lowercase authorization (such as GitLab PRIVATE-TOKEN or mixed-case Authorization) and can follow a cross-origin redirect.
Background info
builder-util-runtime is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.0.0 - 9.6.3.
How to fix this
Upgrade the builder-util-runtime library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant