Skip to content
Fencer Vulns
medium 4.4

CVE-2020-15095 json

Sensitive information exposure through logs in npm cli

published 2020-07-07 6 y ago modified 2026-09-10 1 mo ago also GHSA-93f3-23rq-pjfp , EUVD-2020-0546

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

Patch / fix

  • npm npm 6.14.6
  • npmjs npm 6.14.6
  • npm Debian 14, Debian 13, Debian 12 6.14.6+ds-1

debian advisories DEBIAN-CVE-2020-15095

  • npm RHEL 8 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97
  • nodejs RHEL 8 1:10.23.1-1.module+el8.3.0+9502+012d8a97
  • nodejs-nodemon RHEL 8 1.18.3-1.module+el8+2632+6c5111ed
  • nodejs-full-i18n RHEL 8 1:10.23.1-1.module+el8.3.0+9502+012d8a97
  • nodejs-packaging RHEL 8 17-3.module+el8+2873+aa7dfd9a
  • rh-nodejs10-nodejs RHEL 3 SOFTWARE_COLLECTIONS 10.23.1-2.el7
  • rh-nodejs10-npm RHEL 3 SOFTWARE_COLLECTIONS 6.14.10-10.23.1.2.el7
  • rh-nodejs12-nodejs RHEL 3 SOFTWARE_COLLECTIONS 12.18.4-3.el7

red hat advisories RHSA-2021:0548RHSA-2021:0521RHSA-2020:5086RHSA-2020:4272RHSA-2020:4903

  • nodejs8 SLE Module for Web and Scripting 15 SP1 8.17.0-3.38.1
  • nodejs10 SLES for SAP 15, SLES 15-LTSS, SLE Module for Web and Scripting 15 SP2 +3 more 10.22.1-1.27.1
  • nodejs10 SLE Module for Web and Scripting 12 10.22.1-1.30.1
  • nodejs12 SLE Module for Web and Scripting 15 SP2 12.18.4-4.6.1
  • nodejs12 SLE Module for Web and Scripting 12 12.18.4-1.20.1
  • nodejs8 SLE Module for Web and Scripting 15 SP2 8.17.0-10.3.1

suse advisories SUSE-SU-2020:2870-1SUSE-SU-2020:2829-1SUSE-SU-2020:2823-1SUSE-SU-2020:2813-1SUSE-SU-2020:2812-1SUSE-SU-2020:2800-1

  • nodejs14 openSUSE Tumbleweed 14.17.5-1.2
  • nodejs10 openSUSE Leap 15.2 10.22.1-lp152.2.6.1
  • nodejs8 openSUSE Leap 15.1 8.17.0-lp151.2.21.1
  • nodejs12 openSUSE Leap 15.2 12.18.4-lp152.3.6.1

opensuse advisories openSUSE-SU-2024:11096-1openSUSE-SU-2020:1660-1openSUSE-SU-2020:1644-1openSUSE-SU-2020:1616-1

  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2021:0548ALSA-2020:4272

  • nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
  • nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2021:0548RLSA-2020:4272

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-15095 updated cvss 4.4

npm: sensitive information exposure through logs

  • Red Hat OpenShift Application Runtimes nodejs8 nodejs8
    affected: workaround, no fix planned “Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.23.1-1.module+el8.3.0+9502+012d8a97, nodejs 12.18.4-2.module+el8.2.0+8361+192e434e, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e, +4 more
    fixed: vendor fix “Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.” RHSA-2020:4272
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs 12.18.4-2.module+el8.1.0+8360+14141500, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, nodejs-full-i18n 12.18.4-2.module+el8.1.0+8360+14141500
    fixed: vendor fix “Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.” RHSA-2020:4903
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7
    fixed: vendor fix “Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.” RHSA-2020:5086

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm npm
<6.14.6
6.14.6

Affected products

  • npm cli

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.