GHSA-382c-vx95-w3p5 is a medium-severity (CVSS 6.5) vulnerability in @jsonbored/gittensory-mcp. No vendor fix is recorded yet; mitigation options are listed below.
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
@jsonbored/gittensory-mcpnpmDescription
Summary
GET /v1/contributors/:login/profile and the gittensory_get_contributor_profile MCP tool skip the contributor-scoped access check that every sibling endpoint enforces. Any authenticated session/API/MCP token holder can read any contributor's profile; for confirmed Gittensor miners that exposes alphaPerDay, taoPerDay, usdPerDay (and the hotkey on the REST path). Authenticated cross-contributor disclosure, CWE-284 / IDOR.
Details
In src/api/routes.ts the profile handler returns buildContributorProfile(...) with no requireContributorAccess call. Every sibling (/decision-pack, /repos/:owner/:repo/decision, etc.) gates and 403s on a cross-contributor request — the profile route is the only omission. buildContributorProfile (src/signals/engine.ts) embeds hotkey and the three *PerDay fields for any confirmed miner.
The MCP tool getContributorProfile (src/mcp/server.ts) also omits requireContributorAccess. Its redactSensitiveForMcp filter only strips keys matching hotkey|coldkey|wallet|private_key|privateKey|mnemonic, so the hotkey is dropped but alphaPerDay/taoPerDay/usdPerDay pass through.
The codebase treats these as secret everywhere else — decision-pack.ts destructures the hotkey out before serving, and three sanitizers scrub hotkey/wallet from AI/comment output — which is why this is an oversight, not by-design.
Exposure: REST → hotkey + 3 financial fields; MCP → 3 financial fields (hotkey redacted).
PoC
- Get any valid session/API/MCP token.
- Pick a target
loginthat is a confirmed miner. GET /v1/contributors/{target}/profile→ 200 withgittensor.hotkey,alphaPerDay,taoPerDay,usdPerDay.GET /v1/contributors/{target}/decision-pack(same token) → 403, proving the missing gate.- MCP
gittensory_get_contributor_profilewith{target}→ result includes the three*PerDayfields.
Impact
Any token holder can enumerate other miners' daily TAO/alpha/USD revenue (plus hotkey via REST) without authorization. All miners with snapshot data are affected.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @jsonbored/gittensory-mcp | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @jsonbored/gittensory-mcp, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of @jsonbored/gittensory-mcp has shipped for GHSA-382c-vx95-w3p5 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-382c-vx95-w3p5 in your dependencies?
Find it across npm, including transitive dependencies.