CVE-2020-15095— Sensitive information exposure through logs in npm cli
Quick assessment
Affected
npm cli
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
npm CLI是美国npm公司的一款软件包管理器。 npm CLI 6.14.6之前版本中存在日志信息泄露漏洞。该漏洞源于网络系统或产品的日志文件非正常输出。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sensitive information exposure through logs in npm cli
Source: CVE Program / CVE List V5
Vulnerability Description
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
npm CLI 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
npm CLI是美国npm公司的一款软件包管理器。 npm CLI 6.14.6之前版本中存在日志信息泄露漏洞。该漏洞源于网络系统或产品的日志文件非正常输出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2020-15095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15095
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-15095 (1)
Vendor Advisories for CVE-2020-15095 (2)
-
https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp x_refsource_CONFIRM
-
🔗 NodeJS: Multiple vulnerabilities (GLSA 202101-07) — Gentoo security Read full article vendor-advisory x_refsource_GENTOO
Mailing List Discussions for CVE-2020-15095 (4)
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html vendor-advisory x_refsource_SUSE
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/ vendor-advisory x_refsource_FEDORA
Other References for CVE-2020-15095 (1)
IV. Related Vulnerabilities
Same product: cli
-
CVE-2026-55061
uniget: EDITOR Command Injection in uniget CLI -
CVE-2026-55062
uniget: Path Traversal in Hook Files - Directory Escape Vuln -
CVE-2026-72924
GitHub CLI: `gh codespace ports forward` exposes forwarded s -
CVE-2026-64655
GitHub CLI: Attestation Verification Bypass via Unescaped Re -
CVE-2026-64654
GitHub CLI: Terminal escape sequence injection in multiple `
Same vendor: npm
Same weakness: CWE-532
-
CVE-2026-87980
Security vulnerability affects the UNIX S-TAP component as p -
CVE-2026-87672
Brocade Fabric OS 信息泄露漏洞 -
CVE-2026-16528
ASUS路由器日志注入漏洞，泄露DDNS凭据 -
CVE-2026-106504
Backstage: Sensitive information exposure in scaffolder task -
CVE-2026-106502
Backstage: Sensitive information may be exposed in Scaffolde
V. Comments for CVE-2020-15095
No comments yet