Live › vulnerability › CVE-2026-112147
Go to dashboardOctoally, an ai-genius-automations project, has a flaw in server/src/index.ts where a manipulated path argument discloses information. An attacker can request crafted paths remotely to read data the server should not expose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Octoally up to version 1.0.87 with the server component exposed to a network. The sources do not say which configurations are exposed by default, so treat any reachable deployment as in scope. Teams not running Octoally can skip it.
No product ranges from the sources yet.
1.0.87.server/src/index.ts in your deployment for the path handling code referenced by the advisory.1.0.88 or later, which the advisory says resolves the issue (patch commit 3898085c4e701be21377ebd9e91e10b941e47168).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-112147")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.