What is GHSA-4g6q-77j7-vvjc?

GHSA-4g6q-77j7-vvjc is a security advisory published by GitHub Security Advisories with Medium severity. Logging of the firestore key within nodejs-firestore

Which CVE IDs does GHSA-4g6q-77j7-vvjc cover?

GHSA-4g6q-77j7-vvjc covers the following CVE IDs: CVE-2023-6460. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4g6q-77j7-vvjc?

GHSA-4g6q-77j7-vvjc has a CVSS v3 base score of 4.0, published by GitHub Security Advisories.

Which products are affected by GHSA-4g6q-77j7-vvjc?

GHSA-4g6q-77j7-vvjc affects 1 product, including: npm/@google-cloud/firestore:\u003c 6.1.0.

GHSA-4g6q-77j7-vvjcMediumCVSS 4.0

Logging of the firestore key within nodejs-firestore

Vendor

GitHub Security Advisories

Published

December 4, 2023

Last Modified

May 8, 2026

🔗 CVE IDs covered (1)

CVE-2023-6460 →

📋 Description

A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue

🎯 Affected products1

npm/@google-cloud/firestore:< 6.1.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-6460
https://github.com/googleapis/nodejs-firestore/pull/1742
https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0
https://bughunters.google.com/reports/vrp/KNvgo1Wij
https://github.com/advisories/GHSA-4g6q-77j7-vvjc