Threats tagged 'ghsa-vvw2-c8c7-h7pp'

Dockhand versions from 1.0.47 up to but not including 1.0.54 expose plaintext stack secrets due to the deployStack() function attaching resolved secret values to its result as resolvedSecrets. These secrets, including those from external providers like 1Password or Vault, are returned unfiltered by Git-stack routes. Users with stacks:start permission or holders of a stack's webhook secret can trigger endpoints to access these secrets.