Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

zizmor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.0PyPIAmendedPublished

    zizmor: Debug logging prints available GitHub credentials in cleartext

    CVE-2026-102289 · GHSA-f42p-wjw5-97qh

    Affected
    • PyPI zizmor >= 1.27.0, < 1.28.0
    Fixed in
    1.28.0· Vendor fix available
    Issue
    zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (`GH_TOKEN`, `GITHUB_TOKEN`, `ZIZMOR_GITHUB_TOKEN`), or the corresponding command-line options (`--gh-token`, `--github-token`, `--zizmor-github-token`) are included in the debug representation of the parsed application configuration and written to stderr. The affected logging is enabled by a single `-v`/`--verbose` or an applicable `RUST_LOG` directive. Details The issue was introduced in commit 919bea46, merged through PR #2180. Version `1.26.1` and earlier are unaffected. Version `1.27.0` is the first and only affected release. zizmor accepts GitHub credentials to perform authenticated GitHub API requests for the purposes of retrieving remote GitHub repositories and performing online audits that…

    Recommended action: Upgrade to 1.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →