github.com/mattermost/mattermost-plugin-github (Go)
Advisories
8
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.0.1-0.20260410143745-9b41b1fd43c4 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/mattermost/mattermost-plugin-github@v1.0.1-0.20260410143745-9b41b1fd43c4 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
< 1.0.1-0.20260318132218-6e6b740c4852 | 1.0.1-0.20260318132218-6e6b740c4852 |
| GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories |
Medium EPSS 0.14% |
< 1.0.1-0.20260318132218-6e6b740c4852 | 1.0.1-0.20260318132218-6e6b740c4852 |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
< 1.0.1-0.20260410143745-9b41b1fd43c4 | 1.0.1-0.20260410143745-9b41b1fd43c4 |
| GHSA-jmvr-r5hm-fxfr Mattermost doesn't enforce request body size limits on plugin HTTP endpoints |
High EPSS 0.25% |
< 1.0.1-0.20260410143745-9b41b1fd43c4 | 1.0.1-0.20260410143745-9b41b1fd43c4 |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
< 1.0.1-0.20260330164815-c2840e980b3c | 1.0.1-0.20260330164815-c2840e980b3c |
| GHSA-rmvv-8v8w-rf7x Mattermost doesn't validate user-supplied input in API request handlers |
Medium EPSS 0.25% |
< 1.0.1-0.20260330164815-c2840e980b3c | 1.0.1-0.20260330164815-c2840e980b3c |
| GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection |
Low EPSS 0.18% |
< 1.0.1-0.20250829075715-0deffcfc6bee | 1.0.1-0.20250829075715-0deffcfc6bee |
| GO-2025-4247 Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection |
Low EPSS 0.18% |
< 1.0.1-0.20250829075715-0deffcfc6bee | 1.0.1-0.20250829075715-0deffcfc6bee |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor