← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-796w-fvw2-ccmp: Predictable Non-Exclusive .tmp File Write & Permissive Mode Retention in writeMCPCompileProgress (github/gh-aw)

[ACCEPTED BY GITHUB (DRAFT GHSA) • FIXED IN MERGED PR #73575]
Privately reported to github/gh-aw via GitHub Private Vulnerability Reporting (GHSA-796w-fvw2-ccmp). Accepted by GitHub maintainer Peli de Halleux (@pelikhan) on 2026-10-31T21:51:37Z and fixed in merged Pull Request #73575 (Reuse shared file writer for MCP compile progress).

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-796w-fvw2-ccmp",
  "repository": "github/gh-aw",
  "html_url": "https://github.com/github/gh-aw/security/advisories/GHSA-796w-fvw2-ccmp",
  "fix_pr": "https://github.com/github/gh-aw/pull/73575",
  "state": "draft (accepted by vendor, fix merged in #73575)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter"
    }
  ],
  "cwe_ids": [
    "CWE-377",
    "CWE-732"
  ]
}