gitingest up to version 0.3.1 accepts any hostname that begins with git., gitlab., or github. as valid, regardless of the configured known‑hosts list. This flaw allows an attacker to submit a URL that points to an arbitrary host to the _validate_host routine, resulting in a server‑side request forgery that can be used to reach external servers and expose HTTP basic credentials such as GitHub personal access tokens. The weakness is a server‑side request forgery (CWE‑918) and leads to confidentiality loss of stored tokens and potential misuse of the service’s outbound network.

Coderamp‑labs gitingest, version 0.3.1 and earlier. The vulnerability resides in the _validate_host logic within the Git integration utilities of the open‑source repository hosted on GitHub.

The flaw carries a CVSS score of 8.3, classifying it as high severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. Attackers may still exploit it by crafting malicious URLs that are processed by _validate_host, potentially triggering outbound connections to arbitrary hosts and leaking stored tokens. The description does not specify the exact API or interface that would be used; it is inferred that any entry point accepting URLs could be abused, but this is not explicitly stated. Successful exploitation would provide the attacker with confidential access credentials and allow the compromised server to act as a proxy to internal or external resources.