CVE-2020-5262: Easybuild Project Easybuild

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.

Affected products

• Easybuild Project Easybuild: before 4.1.2 (fixed in 4.1.2)

Published 2020-03-19. Last modified 2026-06-17.