CVE-2026-82289

Gitingest through version 0.3.1 contains a server-side request forgery flaw (CWE-918) in its _validate_host function, which only checks that a submitted URL's hostname begins with the prefixes 'git.', 'gitlab.', or 'github.' instead of verifying membership in a known-hosts list. An attacker can submit a URL with an attacker-controlled hostname such as a lookalike domain bearing one of those prefixes, causing Gitingest to make outbound connections to an arbitrary host. Because Gitingest sends GitHub personal access tokens as HTTP basic credentials when fetching from repositories, those tokens can be disclosed to the attacker-controlled server and then reused against the victim's GitHub account. Anyone running an affected version of Gitingest, or submitting URLs to a service built on it, is affected. There is currently no known public proof-of-concept, no entry in CISA's Known Exploited Vulnerabilities catalog, and a low modeled exploitation probability (EPSS 0.2%), so exploitation has not been observed in the wild.

What to do: Upgrade Gitingest to a release newer than 0.3.1 as soon as a patched version is published, and until then restrict outbound network access from Gitingest deployments to approved hosts (github.com/gitlab.com domains). Operators should check logs for connections to unexpected hostnames starting with git./gitlab./github. that were submitted by untrusted users, and rotate any GitHub personal access tokens configured in Gitingest as a precaution.