hashi-vault-js: Vault token and secret values exposed in thrown errors
Vault token and secret values are exposed in thrown errors when using hashi-vault-js.
Vault token and secret values are exposed in thrown errors when using hashi-vault-js.
The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.