← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-43p9-7988-4jf7: Sisk.Documenting Documentation Exporter Origin/Host Header Link Injection (sisk-http/core)

[ACCEPTED BY VENDOR (DRAFT GHSA) • CVE REQUESTED • FIXED IN COMMIT 51893cf (v1.18.2)]
Privately reported to sisk-http/core via GitHub Private Vulnerability Reporting (GHSA-43p9-7988-4jf7). Accepted by lead maintainer Gabriel Scatolin (@CypherPotato) on 2026-10-31T01:13:21Z with CVE requested from GitHub CNA and patched in commit 51893cf (Sisk.Documenting v1.18.2).

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-43p9-7988-4jf7",
  "repository": "sisk-http/core",
  "package": "nuget:Sisk.Documenting",
  "html_url": "https://github.com/sisk-http/core/security/advisories/GHSA-43p9-7988-4jf7",
  "fix_commit": "https://github.com/sisk-http/core/commit/51893cf",
  "patched_version": "1.18.2",
  "state": "draft (accepted by vendor, CVE requested)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-644",
    "CWE-79"
  ]
}