CVE-2026-82289

HighCVSS 7.4

Published: 28/08/2026(UTC)Updated: 23/09/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.

Risk Assessment

The risk includes unauthorized outbound connections and token leakage, which could lead to account and data security breaches.

Recommendation

Upgrade Gitingest to a version with fixed host validation and restrict URL submission to trusted sources.

Other vulnerabilities in Gitingest

CVE-2026-110767High
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS