GPU VulnDB

Database/AI/ML frameworks & serving

Gitingest: prefix-only host validation lets crafted URLs leak GitHub tokens to attacker hosts

CVE-2026-82289AI/ML frameworks & servingcurated

Impact

Gitingest turns a git repository into a flat text blob for LLM ingestion, so self-hosted instances are commonly wired into RAG and agent pipelines and are handed a GitHub personal access token so they can read private repos. Its host check only tests for a git., gitlab. or github. prefix instead of membership in the known-hosts list, so a URL like github.attacker.tld passes validation. The service then makes an outbound clone request to the attacker's host and sends the configured PAT as HTTP basic credentials, handing over a token that usually carries read access to the organisation's private source. The same primitive gives request forgery from inside whatever network segment the ingestion service sits in.

Who can reach it

Anyone who can submit a repository URL to the Gitingest instance - the hosted and default self-hosted deployments take URLs without authentication; the CVSS vector records user interaction, matching a victim being induced to submit the crafted URL.

What to do

The record names no fixed release - all versions through 0.3.1 are affected and the upstream issue was still open when the advisory was published. Until a fixed version ships, rotate any PAT the instance has held, run it with a token scoped to nothing you cannot afford to lose (or none at all), and restrict its egress so it can only reach the git hosts you intend. Rolling a fix is a container image bump and service redeploy - no node disruption.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-82289https://www.vulncheck.com/advisories/gitingest-prefix-based-git-host-check-enables-request-forgery-and-token-disclosurehttps://github.com/coderamp-labs/gitingest/issues/592https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234a81c8e1a/src/gitingest/utils/git_utils.py

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.