CVE-2025-50178

Name of the Vulnerable Software and Affected Versions: GitForge.jl versions prior to 0.4.3

Description: The issue is related to a lack of input validation for user-provided values in certain functions. Specifically, in the GitForge.get repo function for GitHub, the owner and repo fields can be manipulated by a user to access unintended endpoints on api.github.com by adding path traversal patterns like ../. This is possible because the inputs are not validated or safely encoded before being sent to the server.

Recommendations: For versions prior to 0.4.3, update to version 0.4.3 to resolve the issue. As a temporary workaround, consider validating and safely encoding user-provided inputs for the owner and repo fields in the GitForge.get repo function to prevent path traversal attacks.