Threats tagged 'ghsa-8835-xmqj-354h'

The pgEdge Go LLM Library versions 0.1.0 and 0.1.1 expose fragments of the operator's LLM provider API key in error messages returned by an unauthenticated health endpoint. This occurs because the health handler uses the real credentials to ping providers and returns their error messages verbatim, which often include partially masked credentials. The endpoint is unauthenticated by default unless an Authorize hook is set, allowing any unauthenticated caller with network access to retrieve these fragments. The issue is fixed in version 0.2.0, which redacts credentials from error messages. Users should upgrade and rotate any exposed credentials.