TI-2022-13116 Aliases CVE-2022-31072 GHSA-g28x-pgr3-qqx6

Octokit gem published with world-writable files

LOW 16CWE-276Published 2022-06-15 · Updated 2025-04-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00255 17th percentileScored 2026-11-07

Fix Fixed octokit.rb (octokit): 4.25.0octokit (RubyGems): 4.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
octokit	octokit.rb	4.23.0 to before 4.25.0	4.25.0	Patch available	CNA
—	octokit (RubyGems)	4.23.0 to before 4.25.0	4.25.0	Patch available	GHSA-g28x-pgr3-qqx6

octokit.rb Vendoroctokit Affected 4.23.0 to before 4.25.0 Fixed in 4.25.0 Patch available CNA
octokit (RubyGems) Vendor— Affected 4.23.0 to before 4.25.0 Fixed in 4.25.0 Patch available GHSA-g28x-pgr3-qqx6

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:octokit_project:octokit:4.23.0:::::ruby::	4.23.0	Vulnerable	Octokit Project
cpe:2.3:a:octokit_project:octokit:4.24.0:::::ruby::	4.24.0	Vulnerable	Octokit Project

cpe:2.3:a:octokit_project:octokit:4.23.0:*:*:*:*:ruby:*:* Versions 4.23.0 Vulnerable ·Octokit Project
cpe:2.3:a:octokit_project:octokit:4.24.0:*:*:*:*:ruby:*:* Versions 4.24.0 Vulnerable ·Octokit Project

Remediation

Fix · CNA octokit.rb (octokit) Fixed in 4.25.0
Fix · GHSA-g28x-pgr3-qqx6 octokit (RubyGems) Fixed in 4.25.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-31072
2026-10-03 Alias added: GHSA-g28x-pgr3-qqx6

References

Patch 1

https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55

Advisory 2

Other 2

TI-2025-18944 Regular expression denial of service in octokit request.js CVSS 3.1MEDIUM 5.3
TI-2025-18943 Regular expression denial of service in octokit request-error.js CVSS 3.1MEDIUM 5.3
TI-2025-18942 Regular expression denial of service in octokit plugin-paginate-rest.js CVSS 3.1MEDIUM 5.3
TI-2025-18939 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVSS 3.1MEDIUM 5.3
TI-2023-27674 Unauthenticated Denial of Service in the octokit/webhooks library CVSS 3.1HIGH 7.5
TI-2022-13115 Octopoller gem published with world-writable files CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences