PT-2025-46000 · Julia · Gitforge
Publicado
2025-10-08
·
Atualizado
2025-10-08
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Description
There is a lack of input validation for user-provided values in certain functions.
In the
GitForge.get repo() function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server.Impact
This means a user can add path traversal patterns like
../ in the input to access any other endpoints on api.github.com that were not intended.Patches
Users should upgrade immediately to v0.4.3. All prior versions are vulnerable.
Workarounds
None
References
Fixed by: https://github.com/JuliaWeb/GitForge.jl/pull/50 (which is available in v0.4.3).
Credits
Thanks to splitline from the DEVCORE Research Team for reporting this issue.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gitforge