{"action":"Upgrade renovate to 23.25.1 or later.","affected":[{"fixed":"23.25.1","introduced":"19.180.0"}],"component":"renovate","cve_ids":["CVE-2020-37267"],"ecosystem":"npm","exploited":false,"fixed_versions":["23.25.1"],"ghsa_id":"GHSA-36rh-ggpr-j3gj","id":"tcs_01M5JK7KXF4883X1FSRWG28D0B","modified_at":"2026-10-20T10:56:21.385567281Z","published_at":"2020-09-14T16:38:40Z","references":["https://osv.dev/vulnerability/GHSA-36rh-ggpr-j3gj","https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj","https://github.com/renovatebot/renovate"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-36rh-ggpr-j3gj","url":"https://osv.dev/vulnerability/GHSA-36rh-ggpr-j3gj"},{"source":"nvd","source_id":"CVE-2020-37267","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37267"}],"summary":"Renovate vulnerable to Azure DevOps token leakage in logs"}