Evidence · DiggingBeagle record

GHSA-62c8-mmw9-rq5w: gh-aw workflow path traversal

Combined advisory identifying argument parsing and unsanitized workflow name path handling, fixed in v0.91.12.

Source role: primary disclosure

Evidence record

Combined advisory identifying argument parsing and unsanitized workflow name path handling, fixed in v0.91.12.

Read the original source ↗

Claim-level citations (1)

supportsgh-aw imported workflow names could escape their intended directory: In the affected gh-aw MCP add flow, the supplied workflow name was used as a path component without enforcing that the resulting file remained inside .github/workflows/.
Summary; Issue 2: path traversal; patched versions