GHSA-7543-mr7h-6v86: 
JavaScript vulnerability analysis and mitigation

A high-severity improper authorization vulnerability was identified in the googleapis npm package versions prior to 39.1.0. The vulnerability was discovered in February 2019, published to the GitHub Advisory Database on September 2, 2020, and last updated on January 9, 2023. The issue is tracked as GHSA-7543-mr7h-6v86 and is classified under CWE-285 (Improper Authorization) (GitHub Advisory).

The vulnerability stems from a design flaw where setting credentials on any auth client used in a GoogleApi instance affects all other clients due to the use of GoogleAuth as a singleton. When credentials are set for one client, they may be inadvertently applied to all clients within the same event loop, potentially causing requests to be sent with incorrect credentials (GitHub Issue).

The vulnerability can lead to requests being made with incorrect credentials, potentially exposing sensitive information or allowing unauthorized access to resources. In situations where interleaving execution of the googleapis module occurs, the behavior can produce hazardous results as the last set credentials are used for all subsequent requests regardless of the intended authorization (GitHub Issue).

The vulnerability can be triggered in scenarios where multiple clients are created and used within the same event loop. The issue becomes particularly problematic in concurrent operations where different authorization credentials are being set and used (GitHub Issue).

Users are strongly recommended to upgrade to version 39.1.0 or later of the googleapis package, which contains the fix for this vulnerability (GitHub Advisory).