Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and disclose GitHub personal access tokens via HTTP basic credentials.

Gitingest versions through 0.3.1 contain a critical vulnerability in the _validate_host function that improperly validates hostnames. The flaw allows any hostname prefixed with 'git.', 'gitlab.', or 'github.' to bypass the known-hosts allowlist check. Attackers can craft malicious URLs pointing to attacker-controlled servers to trigger outbound connections from the Gitingest service. This can result in the disclosure of GitHub personal access tokens transmitted via HTTP basic authentication credentials. The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue combined with credential leakage. Affected code resides in git_utils.py and query_parser_utils.py within the Gitingest repository. A GitHub issue (#592) and a VulnCheck advisory have been published documenting the flaw. Users should update to a patched version or implement strict hostname validation to mitigate the risk.