Versions of seneca prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output.

Recommendation

Upgrade to version 3.9.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-5483
• https://hackerone.com/reports/526258
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/501.json
• https://www.npmjs.com/advisories/1155