Is CVE-2026-82289 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82289?

CVE-2026-82289 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-82289

Description

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.