Sourcegraph vulnerabilities
We track 5 vulnerabilities in Sourcegraph products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2023.
Latest Sourcegraph vulnerabilities
- 8.8 High severity
cody: External Control of System or Configuration Setting
Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody confi
- 7.2 High severity
sourcegraph: Incorrect Default Permissions
sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch` feature was enabled. This experimental feature has now been disabled by default. This issue has been
- 7.8 High severity
Sourcegraph is a code intelligence platform.
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host paramete
- 7.2 High severity
sourcegraph: Improper Control of Generation of Code
Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a `ca
- 8.8 High severity
sourcegraph: Missing Authorization
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an a