GitForge.jl Path Traversal Vulnerability in GitHub.repo() Function

A path traversal vulnerability has been identified in GitForge.jl, a package for interacting with Git forges. All versions prior to 5.9.1 are affected. The vulnerability arises from a lack of input validation for user-provided values in the GitHub.repo() function. Users can submit any string for the repo_name field, which is then sent directly to the server without proper validation or encoding. This flaw allows the inclusion of path traversal patterns, such as '../', to access unintended endpoints on api.github.com.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive endpoints on the GitHub API, potentially allowing for manipulation or retrieval of data that should not be accessible.

Remediation

Users are advised to upgrade to version 5.9.1 or later. The latest version is 5.10.0.