CVE-2024-52582

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This may uncover secrets if tool used in CI/build pipelines as it's the main use case. Version 0.14.0 contains a patch for the issue. No known workarounds are available.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Nov 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-525838.2The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page CVE-2024-525845.4Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs CVE-2024-525855.4Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version CVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to v CVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of s CVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to t CVE-2024-525892.7Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and throu CVE-2024-52595.4The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scriptin CVE-2024-525906.5Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows a CVE-2024-525919.3Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `Htt CVE-2024-525925.3Misskey is an open source, federated social media platform. In affected versions missing validation in `ApInboxService.update` allows an att CVE-2024-525935.3Misskey is an open source, federated social media platform.In affected versions missing validation in `NoteCreateService.insertNote`, `ApPer