CVE-2026-82289: Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure
Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitingestto a version that resolves this vulnerability.Fixed in 0.3.1 - Compensating control
Restrict outbound network access for the gitingest service so it cannot connect to arbitrary external hosts when processing attacker-supplied URLs.
Event History
Frequently Asked Questions
Which deployments are exposed?
Gitingest versions through 0.3.1 are affected when they process submitted Git URLs. An attacker can use a hostname beginning with git., gitlab., or github. even if that hostname is not in the known-hosts list.
What does an attacker need to exploit this issue?
The attacker needs to be able to submit a Git URL for Gitingest to process. No authentication is required, but user interaction is required according to the supplied CVSS vector.
What is the practical impact of a successful exploit?
The attacker can cause Gitingest to make outbound connections to attacker-controlled or arbitrary hosts. GitHub personal access tokens may be disclosed through HTTP Basic authentication credentials.