p PatchFirst

PatchFirst · Latest vulnerabilities

@jsonbored/gittensory-mcp vulnerabilities

Vulnerabilities published for @jsonbored/gittensory-mcp in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-382c-vx95-w3p5

    Medium · CVSS 6.5No fix published

    Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

    ### Summary `GET /v1/contributors/:login/profile` and the `gittensory_get_contributor_profile` MCP tool skip the contributor-scoped access check that every sibling endpoint enforces. Any authenticated session/API/MCP token holder can read any contributor's profile; for confirmed Gittensor miners that exposes `alphaPerDay`, `taoPerDay`, `usdPerDay` (and the `hotkey` on the REST path). Authenticated cross-contributor disclosure, CWE-284 / IDOR. ### Details In `src/api/routes.ts` the profile handler returns `buildContributorProfile(...)` with no `requireContributorAccess` call. Every sibling (`/decision-pack`, `/repos/:owner/:repo/decision

    @jsonbored/gittensory-mcpNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →