Skip to content
OpenAdvisories

Package · npm

@jsonbored/gittensory-mcp

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    GHSA-382c-vx95-w3p5

    Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

    ### Summary `GET /v1/contributors/:login/profile` and the `gittensory_get_contributor_profile` MCP tool skip the contributor-scoped access check that every sibling endpoint enforces. Any authenticated session/API/MCP token holder can read any contributor's pr…

    @jsonbored/gittensory-mcp npm