CVE-2026-112147

A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/ai-genius-automations/octoally/
https://github.com/ai-genius-automations/octoally/commit/3898085c4e701be21377ebd9e91e10b941e47168
https://github.com/ai-genius-automations/octoally/issues/24
https://github.com/ai-genius-automations/octoally/releases/tag/v1.0.88
https://vuldb.com/cve/CVE-2026-112147
https://vuldb.com/submit/1013490
https://vuldb.com/submit/1013491
https://vuldb.com/vuln/422254
https://vuldb.com/vuln/422254/cti

Configurations

No configuration.

History

19 Oct 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-19 15:16

Updated : 2026-10-19 20:43

NVD link : CVE-2026-112147

Mitre link : CVE-2026-112147

CVE.ORG link : CVE-2026-112147

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-284

Improper Access Control

{"id": "CVE-2026-112147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112147", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T15:46:47.170624Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:ai-genius-automations:octoally:*:*:*:*:*:*:*:*"], "vendor": "ai-genius-automations", "product": "octoally", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.0.1"}, {"status": "affected", "version": "1.0.2"}, {"status": "affected", "version": "1.0.3"}, {"status": "affected", "version": "1.0.4"}, {"status": "affected", "version": "1.0.5"}, {"status": "affected", "version": "1.0.6"}, {"status": "affected", "version": "1.0.7"}, {"status": "affected", "version": "1.0.8"}, {"status": "affected", "version": "1.0.9"}, {"status": "affected", "version": "1.0.10"}, {"status": "affected", "version": "1.0.11"}, {"status": "affected", "version": "1.0.12"}, {"status": "affected", "version": "1.0.13"}, {"status": "affected", "version": "1.0.14"}, {"status": "affected", "version": "1.0.15"}, {"status": "affected", "version": "1.0.16"}, {"status": "affected", "version": "1.0.17"}, {"status": "affected", "version": "1.0.18"}, {"status": "affected", "version": "1.0.19"}, {"status": "affected", "version": "1.0.20"}, {"status": "affected", "version": "1.0.21"}, {"status": "affected", "version": "1.0.22"}, {"status": "affected", "version": "1.0.23"}, {"status": "affected", "version": "1.0.24"}, {"status": "affected", "version": "1.0.25"}, {"status": "affected", "version": "1.0.26"}, {"status": "affected", "version": "1.0.27"}, {"status": "affected", "version": "1.0.28"}, {"status": "affected", "version": "1.0.29"}, {"status": "affected", "version": "1.0.30"}, {"status": "affected", "version": "1.0.31"}, {"status": "affected", "version": "1.0.32"}, {"status": "affected", "version": "1.0.33"}, {"status": "affected", "version": "1.0.34"}, {"status": "affected", "version": "1.0.35"}, {"status": "affected", "version": "1.0.36"}, {"status": "affected", "version": "1.0.37"}, {"status": "affected", "version": "1.0.38"}, {"status": "affected", "version": "1.0.39"}, {"status": "affected", "version": "1.0.40"}, {"status": "affected", "version": "1.0.41"}, {"status": "affected", "version": "1.0.42"}, {"status": "affected", "version": "1.0.43"}, {"status": "affected", "version": "1.0.44"}, {"status": "affected", "version": "1.0.45"}, {"status": "affected", "version": "1.0.46"}, {"status": "affected", "version": "1.0.47"}, {"status": "affected", "version": "1.0.48"}, {"status": "affected", "version": "1.0.49"}, {"status": "affected", "version": "1.0.50"}, {"status": "affected", "version": "1.0.51"}, {"status": "affected", "version": "1.0.52"}, {"status": "affected", "version": "1.0.53"}, {"status": "affected", "version": "1.0.54"}, {"status": "affected", "version": "1.0.55"}, {"status": "affected", "version": "1.0.56"}, {"status": "affected", "version": "1.0.57"}, {"status": "affected", "version": "1.0.58"}, {"status": "affected", "version": "1.0.59"}, {"status": "affected", "version": "1.0.60"}, {"status": "affected", "version": "1.0.61"}, {"status": "affected", "version": "1.0.62"}, {"status": "affected", "version": "1.0.63"}, {"status": "affected", "version": "1.0.64"}, {"status": "affected", "version": "1.0.65"}, {"status": "affected", "version": "1.0.66"}, {"status": "affected", "version": "1.0.67"}, {"status": "affected", "version": "1.0.68"}, {"status": "affected", "version": "1.0.69"}, {"status": "affected", "version": "1.0.70"}, {"status": "affected", "version": "1.0.71"}, {"status": "affected", "version": "1.0.72"}, {"status": "affected", "version": "1.0.73"}, {"status": "affected", "version": "1.0.74"}, {"status": "affected", "version": "1.0.75"}, {"status": "affected", "version": "1.0.76"}, {"status": "affected", "version": "1.0.77"}, {"status": "affected", "version": "1.0.78"}, {"status": "affected", "version": "1.0.79"}, {"status": "affected", "version": "1.0.80"}, {"status": "affected", "version": "1.0.81"}, {"status": "affected", "version": "1.0.82"}, {"status": "affected", "version": "1.0.83"}, {"status": "affected", "version": "1.0.84"}, {"status": "affected", "version": "1.0.85"}, {"status": "affected", "version": "1.0.86"}, {"status": "affected", "version": "1.0.87"}, {"status": "unaffected", "version": "1.0.88"}]}]}], "published": "2026-10-19T15:16:56.830", "references": [{"url": "https://github.com/ai-genius-automations/octoally/", "source": "cna@vuldb.com"}, {"url": "https://github.com/ai-genius-automations/octoally/commit/3898085c4e701be21377ebd9e91e10b941e47168", "source": "cna@vuldb.com"}, {"url": "https://github.com/ai-genius-automations/octoally/issues/24", "source": "cna@vuldb.com"}, {"url": "https://github.com/ai-genius-automations/octoally/releases/tag/v1.0.88", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-112147", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/1013490", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/1013491", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/422254", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/422254/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.0.88 is sufficient to resolve this issue. The patch is named 3898085c4e701be21377ebd9e91e10b941e47168. It is recommended to upgrade the affected component."}], "lastModified": "2026-10-19T20:43:24.237", "sourceIdentifier": "cna@vuldb.com"}