CVE-2025-62794: GitHub Workflow Updater stored the optional Github token in plaintext
GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" api. An attacker with read only access to your home directory could have read this token and used it to perform actions with that token. Update to 0.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitHub Workflow Updaterto a version that resolves this vulnerability.Fixed in 0.0.7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62794?
CVE-2025-62794 has a severity rating that indicates it poses a moderate risk to users of the affected version.
How do I fix CVE-2025-62794?
To fix CVE-2025-62794, upgrade the GitHub Workflow Updater extension to version 0.0.7 or later.
What specific issue does CVE-2025-62794 address?
CVE-2025-62794 addresses the insecure storage of GitHub tokens in plaintext in the editor configuration.
Which versions of GitHub Workflow Updater are affected by CVE-2025-62794?
CVE-2025-62794 affects versions of GitHub Workflow Updater prior to 0.0.7.
Is my data at risk due to CVE-2025-62794?
Yes, if you are using an affected version of the GitHub Workflow Updater and have utilized a GitHub token, your data may be at risk due to its insecure storage.