CVE-2026-82289

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.

  • Published Aug 28, 2026
  • CVSS 8.3 high
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-82289 at the National Vulnerability Database