Octopoller gem published with world-writable files
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| octokit | octopoller.rb | = 0.2.0 | — | No fix listed | CNA |
| — | octopoller (RubyGems) | 0.2.0 to before 0.3.0 | 0.3.0 | Patch available | GHSA-26qj-cr27-r5c4 |
- octopoller.rb Vendoroctokit Affected = 0.2.0 Fixed in — No fix listed CNA
- octopoller (RubyGems) Vendor— Affected 0.2.0 to before 0.3.0 Fixed in 0.3.0 Patch available GHSA-26qj-cr27-r5c4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:octopoller_project:octopoller:0.2.0:*:*:*:*:ruby:*:* | 0.2.0 | Vulnerable | Octopoller Project |
- cpe:2.3:a:octopoller_project:octopoller:0.2.0:*:*:*:*:ruby:*:* Versions 0.2.0 Vulnerable ·Octopoller Project
Remediation
- Fix · GHSA-26qj-cr27-r5c4 octopoller (RubyGems) Fixed in 0.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31071
- 2026-10-03 Alias added: GHSA-26qj-cr27-r5c4
References
Advisory 2
More octokit vulnerabilities
- TI-2025-18944 Regular expression denial of service in octokit request.js CVSS 3.1MEDIUM 5.3
- TI-2025-18943 Regular expression denial of service in octokit request-error.js CVSS 3.1MEDIUM 5.3
- TI-2025-18942 Regular expression denial of service in octokit plugin-paginate-rest.js CVSS 3.1MEDIUM 5.3
- TI-2025-18939 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVSS 3.1MEDIUM 5.3
- TI-2023-27674 Unauthenticated Denial of Service in the octokit/webhooks library CVSS 3.1HIGH 7.5
- TI-2022-13116 Octokit gem published with world-writable files CVSS 3.1LOW 3.3
Sources
- CVE-2022-31071 · CVE Program
- CVE-2022-31071 · NVD
- FIRST EPSS
- GHSA-26qj-cr27-r5c4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences