CVE-2025-50178

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-50178
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50178.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-50178
Aliases
Published
2025-06-25T15:12:24.751Z
Modified
2026-04-02T12:51:50.162091Z
Severity
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
GitForge.jl lacks validation for user provided fields
Details

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functions. In the GitForge.get_repo function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like ../ in the input to access any other endpoints on api.github.com that were not intended. Version 0.4.3 contains a patch for the issue. No known workarounds are available.

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50178.json"
}
References

Affected packages

Git / github.com/juliaweb/gitforge.jl

Affected ranges

Type
GIT
Repo
https://github.com/juliaweb/gitforge.jl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
527332b8da1b729f390aabe895b00cc8869a1b64
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.3"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.4.0
v0.4.1
v0.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50178.json"