Vulnerability details

CVE-2026-82289

coderamp-labs gitingest

Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

CVSS 4.0

8.3High

Official description

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.

CVSS scores

Score	Version	Source	Vector
8.3High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N`
7.4High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
coderamp-labs	gitingest	v ≤ 0.3.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/coderamp-labs/gitingest product
https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234a81c8e1a/src/gitingest/utils/query_parser_utils.py technical-description
https://github.com/coderamp-labs/gitingest/blob/4e259a02fe72115bee538271622f1234a81c8e1a/src/gitingest/utils/git_utils.py technical-description
https://www.vulncheck.com/advisories/gitingest-prefix-based-git-host-check-enables-request-forgery-and-token-disclosure third-party-advisory
https://github.com/coderamp-labs/gitingest/issues/592 issue-tracking

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-28
Last updated: 2026-09-24
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

38.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery (SSRF)