Sensitive Credential Exposure in HL7 FHIR IG Publisher Tool

CVE-2025-24363

What is CVE-2025-24363?

The HL7 FHIR IG Publisher tool, used to create standard FHIR Implementation Guides (IGs), has a vulnerability where it may expose sensitive credentials. In versions prior to 1.8.9, the IG Publisher CLI utilizes git commands to identify the originating repository URL. If the repository is set to a username and credential-based URL, this information becomes part of the built Implementation Guide, potentially exposing usernames and passwords. This vulnerability does not affect users cloning public repositories. Users are advised to verify their IG repository configurations to ensure no sensitive information is included in the origin URL. The issue was resolved in version 1.8.9, and users are encouraged to adopt the patch and utilize workarounds, such as specifying a secure URL using the -repo parameter.

References