Octokit 安全漏洞

Octokit is a Ruby toolkit for the GitHub API. A security vulnerability exists in Octokit version 9.0.5 through versions prior to 10.1.3, which stems from a regular expression denial of service ReDoS attack that can be caused by crafting a specific options parameter...

PT-2025-7072

Name of the Vulnerable Software and Affected Versions: @octokit/request-error versions 1.0.0 through 6.1.6 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long...

Octokit 安全漏洞

Octokit is a Ruby toolkit for the GitHub API. A security vulnerability exists in Octokit version 1.0.0 through versions prior to 11.4.1, which stems from a specially crafted instance of octokit that may trigger a Regular Expression Denial of Service ReDoS attack...

PT-2025-7071

Name of the Vulnerable Software and Affected Versions: @octokit/plugin-paginate-rest versions 1.0.0 through 11.4.1 Description: The issue is a Regular Expression Denial of Service ReDoS vulnerability that can be triggered when calling octokit.paginate.iterator with a specially crafted octokit...

PT-2025-7073

Name of the Vulnerable Software and Affected Versions: @octokit/request versions 1.0.0 through 9.2.1 Description: The regular expression /+; rel="deprecation"/ used to match the link header in HTTP responses is vulnerable to a ReDoS Regular Expression Denial of Service attack. This vulnerability...

Octokit 安全漏洞

Octokit is a Ruby toolkit for the GitHub API. A security vulnerability exists in Octokit version 1.0.0 through versions prior to 9.2.1, which stems from the unrestricted nature of the regular expression matching behavior, and could lead to catastrophic backtracking when processing ad-hoc input,...

Denial Of Service (DoS)

@octokit/webhooks is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack of exception handling in the verifyAndReceive method within src/verify-and-receive.ts. This method internally calls another method verify which throws an exception which remains unhandled. This uncaugh...

CVE-2023-50728

An uncaught exception vulnerability was found in octokit webhooks. An error may be undefined in some cases, and the resulting request can cause an uncaught exception that ends the nodejs process...

@35iter/github-event (=0.0.0), @42toolkit/scrapper (>=1.2.0 <=2.2.0) +404 more potentially affected by CVE-2023-50728 via octokit (>=0.10.4 <=3.1.1)

octokit NPM version =0.10.4, =1.2.0, =1.0.0, =0.1.0, =3.118.0, =1.79.0, =0.0.1, =1.0.8, =0.1.0, =0.1.0, =0.0.0-nightly-20220427024951, =0.0.0-nightly-20220803025242, =0.0.0-nightly-2021712211, =0.0.0-nightly-20220708025041, =0.0.0-nightly-20231213021616, =0.0.0-nightly-20231222021330 and more...

GHSA-PWFR-8PQ7-X9QV Unauthenticated Denial of Service in the octokit/webhooks library

Impact Versions v9.26.0, v10.9.x, v11.1.x, v12.0.x all contained the code that would throw the error. Specifically, during a pentest we encountered a bug in the octokit/webhooks library a dependency of Probot, a framework for building Github Apps. The resulting request was found to cause an...

Unauthenticated Denial of Service in the octokit/webhooks library

Impact Versions v9.26.0, v10.9.x, v11.1.x, v12.0.x all contained the code that would throw the error. Specifically, during a pentest we encountered a bug in the octokit/webhooks library a dependency of Probot, a framework for building Github Apps. The resulting request was found to cause an...

CVE-2023-50728

CVE-2023-50728 affects the octokit/webhooks library used by Node.js projects. The root cause is a flaw in error handling where an error can be undefined, causing an uncaught exception that terminates the Node.js process. Affected versions include 9.26.0 through 9.26.3, 10.9.2, 11.1.2, and 12.0.4....

CVE-2023-50728 Unauthenticated Denial of Service in the octokit/webhooks library

octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request w...

Octokit Security Breach

Octokit is a Ruby toolkit for the GitHub API. A security vulnerability exists in Octokit that originates from allowing an unauthenticated attacker to cause a denial of service DOS. Affected products and versions: octokit/webhooks version 14.0.1, versions prior to v3.1.1, versions prior to v12.3.2...

PT-2023-31626 · Github · Octokit/Webhooks +1

Name of the Vulnerable Software and Affected Versions: octokit/webhooks versions 9.26.0 through 9.26.2 octokit/webhooks versions 10.9.0 through 10.9.1 octokit/webhooks versions 11.1.0 through 11.1.1 octokit/webhooks versions 12.0.0 through 12.0.3 Description: The issue is caused by a problem with...

GitLab: RCE via github import

Hello, While continuing mining on github import, I found a vulnerability on gitlab.com allowing to execute remotely arbitrary commands. Gitlab uses Octokit to get data from github.com. Octokit uses Sawyer::Resource to represent results. Sawyer is a crazy class that converts a hash to an object...

Insecure Permissions

Overview Affected versions of this package are vulnerable to Insecure Permissions due to the gem file containing world-writeable files. This means everyone who is not the owner Group and Public with access to the instance where this release had been installed could modify the world-writable files...

Privilege Escalation

octokit is vulnerable to privilege escalation. The vulnerability exists because the script file uses -rw-rw-rw- i.e. 0666 permission instead of rw-r--r--i.e. 0644, allowing an attacker to modify the world-writable files...

CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...