Vulnerability Description
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/coderamp-labs/gitingest
- https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234
- https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234
- https://github.com/coderamp-labs/gitingest/issues/592
- https://www.vulncheck.com/advisories/gitingest-prefix-based-git-host-check-enabl
- https://github.com/coderamp-labs/gitingest/issues/592
FAQ
What is CVE-2026-82289?
CVE-2026-82289 is a vulnerability with a CVSS score of 7.4 (HIGH). Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can subm...
How severe is CVE-2026-82289?
CVE-2026-82289 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82289?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.