CVE-2026-82289

Name of the Vulnerable Software and Affected Versions Gitingest versions prior to 0.3.2

Description The software fails to properly validate hostnames within the validate host() function. It accepts any host starting with the prefixes git., gitlab., or github., ignoring whether the host is a member of the known-hosts list. This allows attackers to submit URLs with controlled hostnames to trigger outbound connections to arbitrary hosts, potentially disclosing GitHub personal access tokens through HTTP basic credentials.

Recommendations Update Gitingest to version 0.3.2 or later.