{"id":"CVE-2022-31072","aliases":["GHSA-g28x-pgr3-qqx6"],"url":"https://o3.security/vulnerability/CVE-2022-31072","summary":"Octokit gem published with world-writable files","details":"### Impact\n\nVersions [4.23.0](https://rubygems.org/gems/octokit/versions/4.23.0) and [4.24.0](https://rubygems.org/gems/octokit/versions/4.24.0) of the octokit gem were published containing world-writeable files. \n\nSpecifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. \n\nMalicious code already present and running on your machine, separate from this package, could modify the gem’s files and change its behavior during runtime.\n\n### Patches\n* [octokit 4.25.0](https://rubygems.org/gems/octokit/versions/4.25.0)\n\n### Workarounds\nUsers can use the previous version of the gem [v4.22.0](https://rubygems.org/gems/octokit/versions/4.22.0). Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.\n\n","published":"2022-06-15T22:35:10Z","modified":"2026-10-28T02:31:00.969126263Z","cvss":{"score":2.5,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"octokit","fixedVersion":"4.25.0"}],"fix":{"url":"https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55","label":"octokit/octokit.rb@1c8edec"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31072.json"},{"type":"ADVISORY","url":"https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31072"},{"type":"FIX","url":"https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55"},{"type":"PACKAGE","url":"https://github.com/octokit/octokit.rb"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/octokit/CVE-2022-31072.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:00.969126263Z"}}