Threat database

Gitingest versions up to 0.3.1 contain a vulnerability where unauthenticated attackers can exploit symlink following in the ingest_query single-file blob ingestion feature. This allows attackers to read server files accessible to the service user by submitting symlink blob URLs, potentially exposing sensitive data up to 10 MB in size.

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.