CVE-2026-82289: Server-Side Request Forgery (SSRF) in coderamp-labs gitingest

The vulnerability in gitingest through version 0.3.1 arises from improper hostname validation in the _validate_host function. The software accepts any hostname starting with git., gitlab., or github. prefixes without verifying membership in the known-hosts list. This flaw allows attackers to craft URLs with malicious hostnames that cause the server to make outbound connections to arbitrary hosts. Consequently, attackers can exploit this to disclose sensitive GitHub personal access tokens transmitted via HTTP basic authentication.

Successful exploitation can lead to unauthorized outbound connections from the vulnerable server to attacker-controlled hosts. This can result in the disclosure of GitHub personal access tokens, which may be used to access or manipulate GitHub repositories or services associated with the token. The vulnerability has a high severity score of 8.3, indicating significant risk if exploited.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement network-level controls to restrict outbound connections from the gitingest service to untrusted hosts.