Read the docs
TI-2025-32664 Aliases CVE-2025-52569

GitHub.jl lacks validation for user-provided fields

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide any string for the `repo_name` field. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on `api.github.com` that were not intended. Users should upgrade immediately to v5.9.1 or later to receive a patch. All prior versions are vulnerable. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed GitHub.jl (JuliaWeb): 5.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuliaWebGitHub.jlbefore 5.9.15.9.1Patch availableCNA
  • GitHub.jl VendorJuliaWeb Affected before 5.9.1 Fixed in 5.9.1 Patch available CNA

Remediation

  • Fix · CNA GitHub.jl (JuliaWeb) Fixed in 5.9.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52569

References

Other 2

  • TI-2025-32606 HTTP.jl vulnerable to CR/LF Injection in URIs CVSS 4.0HIGH 7.7
  • TI-2025-38120 HTTP.jl vulnerable to Header injection/Response splitting via header construction. CVSS 4.0HIGH 8.7
  • TI-2025-32061 GitForge.jl lacks validation for user provided fields CVSS 4.0MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences