https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T20:22:35.609615+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-19503 cnvd-2020-19503 2026-10-15T20:22:35.613657+00:00 cnvd-2020-19503 https://cve.radiocsirt.org/vuln/euvd-2026-36523 EUVD-2026-36523 2026-10-15T20:22:35.613693+00:00 EUVD-2026-36523 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5262 fkie_cve-2020-5262 2026-10-15T20:22:35.613707+00:00

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.

 https://cve.radiocsirt.org/vuln/ghsa-2wx6-wc87-rmjm GHSA-2wx6-wc87-rmjm — GitHub personal access token leaking into temporary EasyBuild (debug) logs 2026-10-15T20:22:35.613737+00:00

Affected: PyPI: easybuild-framework

### Impact

The GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--from-pr`, etc.) is shown in plain text in EasyBuild debug log files.

Scope:

* the log message only appears in the top-level log file, *not* in the individual software installation logs (see https://easybuild.readthedocs.io/en/latest/Logfiles.html); - as a consequence, tokens are *not* included in the partial log files that are uploaded into a gist when using `--upload-test-report` in combination with `--from-pr`, nor in the installation logs that are copied to the software installation directories; * the message is only logged when using `--debug`, so it will not appear when using the default EasyBuild configuration (only info messages are logged by default); * the log message is triggered via `--from-pr`, but also via various other GitHub integration options like `--new-pr`, `--merge-pr`, `--close-pr`, etc., but usually only appears in the temporary log file that is cleaned up automatically as soon as eb completes successfully; * you may have several debug log files that include your GitHub token in `/tmp` (or a different location if you've set the `--tmpdir` EasyBuild configuration option) on the systems where you use EasyBuild, but they are located in a subdirectory that is only accessible to your account (permissions set to 700); * the only way that a log file that may include your token could have been made public is *if you shared it yours…

 https://cve.radiocsirt.org/vuln/gsd-2020-5262 gsd-2020-5262 2026-10-15T20:22:35.613787+00:00 gsd-2020-5262 https://cve.radiocsirt.org/vuln/pysec-2020-268 PYSEC-2020-268 2026-10-15T20:22:35.613800+00:00

Affected: PyPI: easybuild

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.