CVE-2026-112147: Information Disclosure in ai-genius-automations octoally
Description
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
CVSS v4.0
Score 6.9medium
Affected software
ai-genius-automations
octoally
pkg:npm/ai-genius-automations/octoallycpe:2.3:a:ai-genius-automations:octoally:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in ai-genius-automations octoally (up to version 1.0.87) involves an information disclosure caused by manipulation of the argument path in a function located in server/src/index.ts. The flaw allows remote attackers to obtain sensitive information. A patch identified by commit 3898085c4e701be21377ebd9e91e10b941e47168 fixes the issue in version 1.0.88. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with an attack vector of network, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.
Potential Impact
Successful exploitation can lead to unauthorized disclosure of information from the affected system. The vulnerability can be exploited remotely without authentication or user interaction, potentially exposing sensitive data. The impact is limited to information disclosure with no direct integrity or availability effects reported.
Mitigation Recommendations
A fix is available in version 1.0.88 of ai-genius-automations octoally. It is recommended to upgrade all affected installations to this version to remediate the vulnerability. No other mitigation steps are specified or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-19T05:45:16.728Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad62a5f2cdf04f6566123a6
Added to database: 10/19/2026, 14:34:07 UTC
Last enriched: 10/19/2026, 14:48:16 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.