Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosError(err), which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and the request body. Consuming applications that log caught errors (e.g., using console.error, pino, winston, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via err.config.data. Impact When consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance. Patches This vulnerability should be addressed by redacting err.config.headers['X-Vault-Token']…
Recommended action: Upgrade to 0.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library. Details There are zero calls to encodeURIComponent anywhere in Vault.js. Every identifier (e.g., name, username, group, role, version) provided to the library is concatenated straight into the HTTP URL without URI encoding. Two vectors can be dynamically confirmed: 1. Path Traversal: Passing ../../sys/seal as a secret name causes the HTTP client to normalize the path and send the request to /v1/sys/seal instead of the intended Key-Value path. 2. Query Injection: Passing 1&list=true as a version value injects an extra query parameter into the request payload. Impact In applications where Vault identifiers originate from…
Recommended action: Upgrade to 0.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.