ossf allstar prior 0.0.0-20250721181116-e004ecb540d6 Reviewbot variable initialization

Summaryinfo

A vulnerability categorized as critical has been discovered in ossf allstar. The impacted element is an unknown function of the component Reviewbot. Such manipulation leads to variable initialization. This vulnerability is listed as CVE-2025-61926. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in ossf allstar. Affected by this issue is an unknown functionality of the component Reviewbot. The manipulation with an unknown input leads to a variable initialization vulnerability. Using CWE to declare the problem leads to CWE-453. The product, by default, initializes an internal variable with an insecure or less secure value than is possible. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-61926 since 10/04/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 0.0.0-20250721181116-e004ecb540d6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-33544). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• ossf

Name

• allstar

Website

• Product: https://github.com/ossf/allstar/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion