CVE-2025-50178: GitForge.jl Path Traversal Vulnerability

CVE-2025-50178 Overview

CVE-2025-50178 affects GitForge.jl, a Julia package that provides a unified interface for interacting with Git forges such as GitHub. Versions prior to 0.4.3 lack input validation for user-supplied values in several functions. The GitForge.get_repo function for GitHub accepts arbitrary strings for the owner and repo fields without validation or safe URL encoding. Attackers can supply path traversal sequences such as ../ to reach unintended endpoints on api.github.com. The issue is classified as [CWE-20: Improper Input Validation]. Maintainers released a fix in version 0.4.3.

Critical Impact
Applications built on GitForge.jl can be coerced into issuing requests to arbitrary GitHub API endpoints, potentially exposing data not intended by the calling application.

Affected Products

GitForge.jl versions prior to 0.4.3
Julia applications embedding GitForge.jl for GitHub API interactions
Downstream tools relying on GitForge.get_repo for repository lookups

Discovery Timeline

2025-06-25 - CVE-2025-50178 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50178

Vulnerability Analysis

GitForge.jl builds GitHub REST API request URLs by interpolating caller-supplied owner and repo strings directly into the request path. The library does not validate the character set of these inputs and does not apply URL encoding before dispatching the request. An attacker who controls either value can inject path segments, including ../ sequences, that alter the resolved endpoint on api.github.com.

The consequence is a request forwarded to an unintended GitHub API path with the caller's authentication context. Depending on how the host application supplies credentials, this can result in data retrieval from repositories, users, or organizations that the application never intended to query. The vulnerability is categorized as an input validation flaw [CWE-20] rather than a memory safety or code execution issue.

Root Cause

The root cause is missing input validation and missing URL encoding in the request construction path of GitForge.get_repo and related functions. User-controlled strings are concatenated into the request URI without normalization. Any character permitted by the transport layer, including path separators and traversal tokens, flows through to the outbound HTTP call.

Attack Vector

Exploitation requires an application that forwards untrusted input into GitForge.get_repo or similar functions. An attacker submits a crafted owner or repo value such as ..%2f..%2fusers%2fvictim or ../../user. The library appends this value to the base API path and issues the request. The GitHub API resolves the traversal and returns data from the substituted endpoint. See the GitHub Security Advisory and the GitHub Pull Request for the technical fix.

Detection Methods for CVE-2025-50178

Indicators of Compromise

Outbound HTTPS requests to api.github.com containing ../, ..%2f, or other path traversal encodings in the URI.
Unexpected GitHub API responses returning data for repositories, users, or organizations outside the application's normal scope.
Application logs showing GitForge.get_repo invocations with owner or repo arguments containing path separators.

Detection Strategies

Inspect HTTP client telemetry from Julia processes for GitHub API paths that deviate from the expected /repos/{owner}/{repo} structure.
Audit source code and dependency manifests (Project.toml, Manifest.toml) for GitForge.jl versions below 0.4.3.
Correlate application access logs with outbound GitHub API traffic to identify user inputs containing traversal patterns.

Monitoring Recommendations

Enable request logging on egress proxies fronting Julia workloads and alert on GitHub API URIs containing encoded or literal ../ sequences.
Track dependency versions across build pipelines and flag any use of GitForge.jl prior to 0.4.3.
Review GitHub audit logs for API tokens used by GitForge.jl clients to identify anomalous access patterns.

How to Mitigate CVE-2025-50178

Immediate Actions Required

Upgrade GitForge.jl to version 0.4.3 or later in all Julia projects and rebuild dependent applications.
Inventory all call sites that pass externally sourced values into GitForge.get_repo and validate inputs at the application boundary.
Rotate any GitHub tokens used by affected applications if traversal patterns are observed in historical logs.

Patch Information

The fix is included in GitForge.jl 0.4.3 and is documented in the upstream pull request and the GHSA-g2xx-229f-3qjm advisory. The maintainers state that no workarounds are available outside of upgrading.

Workarounds

No official workarounds are available; the maintainers direct users to upgrade to 0.4.3.
As a defense-in-depth measure, validate owner and repo inputs against a strict allowlist regex such as ^[A-Za-z0-9._-]+$ before invoking GitForge functions.
Restrict the scope of GitHub tokens used by GitForge.jl clients to the minimum repositories and permissions required.

bash

# Update GitForge.jl to the patched release in a Julia project
julia -e 'using Pkg; Pkg.update("GitForge"); Pkg.status("GitForge")'

# Verify the installed version is >= 0.4.3
julia -e 'using Pkg; v = Pkg.dependencies()[Base.UUID(Pkg.project().dependencies["GitForge"])].version; @assert v >= v"0.4.3"'