CVE-2025-50178

Vulnerability

Overview

GitForge.jl versions prior to 0.4.3 do not validate user-supplied input for the owner and repo parameters in the GitForge.get_repo function for GitHub. These values are directly embedded into the API request URL without sanitization, enabling path traversal sequences like ../ to be injected [1][2].

Exploitation

An attacker who can control the owner or repo arguments passed to GitForge.get_repo can craft strings such as "../octocat/Hello-World" to navigate the URL path. This allows the attacker to reach unintended endpoints on api.github.com that the library normally would not access. No authentication or special network position is required beyond the ability to supply input to the vulnerable function [1][2].

Impact

By exploiting the path traversal, an attacker can query arbitrary GitHub API endpoints, potentially accessing sensitive information or performing actions that the application's intended use of the library would not permit. The exact impact depends on the endpoints reached and the permissions of the underlying GitHub token used by the application [2].

Mitigation

The issue is fixed in GitForge.jl version 0.4.3, which adds checks to disallow path navigation and newline characters in endpoint URLs. Users should upgrade immediately; no workarounds are available [1][2].