Path Traversal Vulnerability in GitForge.jl by JuliaWeb

CVE-2025-50178

What is CVE-2025-50178?

GitForge.jl, a unified interface for Git forges, suffers from a significant input validation flaw in versions prior to 0.4.3. Specifically, the vulnerability exists in the GitForge.get_repo function, where user-provided strings for the owner and repository fields are not adequately validated or encoded. This oversight allows malicious users to exploit the application by injecting path traversal patterns, such as ../, into their inputs, potentially granting them unauthorized access to sensitive endpoints on the GitHub API that should not be accessible. The issue has been addressed in version 0.4.3, and users are encouraged to update to this version to mitigate associated risks.

References