High severity7.5NVD Advisory· Published Aug 19, 2026

CVE-2019-25766

Description

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

Affected products

Renovatebot/renovatellm-fuzzy
Range: >=13.87.0 <=19.38.6

Patches

Vulnerability mechanics

References

github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjgnvd
www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modulesnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000