CVE-2025-53624: 
JavaScript vulnerability analysis and mitigation

The Docusaurus gists plugin (docusaurus-plugin-content-gists) versions prior to 4.0.0 contain a critical security vulnerability identified as CVE-2025-53624. The vulnerability was discovered and disclosed on July 9, 2025, affecting all versions of the plugin before version 4.0.0. The issue exposes GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The plugin, which adds functionality to display public gists of a GitHub user in Docusaurus instances, inadvertently includes build-time API access tokens in client-side JavaScript bundles (GitHub Advisory, NVD).

The vulnerability stems from improper handling of authentication tokens in the build process. When configured using the recommended pattern with personalAccessToken option, the GitHub Personal Access Token gets bundled into the production build artifacts, specifically in the file '/build/assets/js/main.[hash].js'. The vulnerability has received a CVSS v3.1 base score of 10.0 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low complexity, no privileges required, and high impact on confidentiality, integrity, and availability (GitHub Advisory).

The exposure of GitHub Personal Access Tokens allows malicious actors to extract and use the token to access the token owner's GitHub account with the granted permissions. This could potentially lead to unauthorized access to private gists, repositories, or other actions depending on the token's scope. The vulnerability is particularly severe as it exposes sensitive credentials that could be used for further attacks or unauthorized access to GitHub resources (GitHub Advisory).

The vulnerability has been fixed in version 4.0.0 of the plugin. Users should immediately upgrade to version 4.0.0 or later, remove the personalAccessToken from their plugin configuration, and ensure GHPERSONALACCESS_TOKEN is set in their build environment. Additionally, it is crucial to immediately revoke access to any GitHub PAT that was previously used with affected versions. The new version implements a split architecture for security where the token is only read from the environment during build time, and runtime configuration excludes sensitive data (GitHub Commit).