Get the latest tech news
IntelliJ GitHub Plugin leaking credentials
A new security issue was discovered that affects the JetBrains GitHub plugin on the IntelliJ platform, which could lead to disclosure of access tokens to third-party sites. The issue affects all IntelliJ-based IDEs as of 2023.1 onwards that have the JetBrains GitHub plugin enabled and configured/in-use.
A new security issue was discovered that affects the JetBrains GitHub plugin on the IntelliJ Platform, which could lead to disclosure of access tokens to third-party sites. Aqua: 2024.1.2 CLion: 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2 DataGrip: 2024.1.4 DataSpell: 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2 GoLand: 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3 IntelliJ IDEA: 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3 MPS: 2023.2.1, 2023.3.1, 2024.1 EAP2 PhpStorm: 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3 PyCharm: 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2 Rider: 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3 RubyMine: 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4 RustRover: 2024.1.1 WebStorm: 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4 In particular, malicious content as part of a pull request to a GitHub project which would be handled by IntelliJ-based IDEs, would expose access tokens to a third-party host.
Or read this on Hacker News