{"id":125662,"date":"2025-05-28T15:05:18","date_gmt":"2025-05-28T13:05:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev"},"modified":"2025-05-28T15:05:18","modified_gmt":"2025-05-28T13:05:18","slug":"uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","title":{"rendered":"Vulnerabilitate \u00een serverul MCP GitHub, care duce la scurgeri de informa\u021bii din repozitorii private.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pe serverul GitHub MCP, implementarea protocolului MCP (Model Context Protocol) de la GitHub, a fost descoperit\u0103 o vulnerabilitate care permite extragerea de date din repozitoriile private ale utilizatorilor care folosesc asisten\u021bi AI pentru automatizarea muncii cu repozitoriile. <\/p>\n

Protocolul MCP este destinat leg\u0103rii modelelor AI cu diverse surse de date. Serverul GitHub MCP asigur\u0103 o integrare fluid\u0103 a modelelor lingvistice mari cu API-ul GitHub, oferind acestor modele un context suplimentar prin extragerea de date din repozitoarele GitHub. Modelele care utilizeaz\u0103 MCP pot fi aplicate pentru automatizarea anumitor ac\u021biuni pe GitHub, de exemplu, pentru analiza mesajelor de eroare. <\/p>\n

Esenta vulnerabilit\u0103\u021bii const\u0103 \u00een faptul c\u0103, prin interac\u021biunea cu o mare model lingvistic conectat\u0103 la GitHub, se poate ob\u021bine divulgarea unor date confiden\u021biale despre utilizatorul care a legat agentul AI de contul s\u0103u de GitHub. Atacatorul poate publica \u00eentr-un repozitoriu public, pentru care se aplic\u0103 automatizarea bazat\u0103 pe un model lingvistic mare, un raport despre problem\u0103 (issue) contruit special. Dup\u0103 activare, modelul va genera un pull request cu solu\u021bia propus\u0103. Prin urmare, dac\u0103 problema se refer\u0103 la repozitorii priva\u021bi sau date confiden\u021biale, modelul poate dezv\u0103lui informa\u021bii \u00een pull request-ul sugerat.

\"Vulnerabilitate<\/center> <\/p>\n

De exemplu, a fost trimis un mesaj despre eroare cu pl\u00e2ngerea c\u0103 \u00een fi\u0219ierul README nu este men\u021bionat autorul. Ca solu\u021bie, mesajul a propus ad\u0103ugarea informa\u021biilor despre autor \u00een README \u0219i o list\u0103 a tuturor repozitoriilor cu care a colaborat autorul. \u00cen final, modelul a creat un pull request cu informa\u021bii care includeau date personale despre autor, extrase dintr-un repozitoriu privat, precum \u0219i o list\u0103 a repozitoriilor private existente. \u00cen etapa urm\u0103toare, printr-o interac\u021biune similar\u0103 cu modelul, se pot ob\u021bine \u0219i date dintr-un anumit repozitoriu privat. <\/p>\n

Pentru a activa agentul AI, este necesar ca proprietarul magazinului s\u0103 solicite analiza mesajelor de eroare. \u00cen cazul \u00een care GitHub este conectat la serviciul AI Claude, este suficient ca proprietarul s\u0103 trimit\u0103 asistentului AI o cerere de tipul \u201euite la issue-urile din magazinele mele cu cod deschis \u0219i solu\u021bioneaz\u0103-le\u201d. Dup\u0103 aceea, asistentul AI va activa integrarea MCP configurat\u0103 cu contul de GitHub \u0219i va urm\u0103ri instruc\u021biunile con\u021binute \u00een mesajele despre probleme.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 GitHub MCP Server, \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 MCP (Model Context Protocol) \u043e\u0442 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 AI-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u044b \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c\u0438. \u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b MCP \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043d\u0438\u044f AI-\u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. GitHub MCP Server \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u0435\u0441\u0448\u043e\u0432\u043d\u0443\u044e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044e \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0441 API GitHub \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u044d\u0442\u0438\u043c \u043c\u043e\u0434\u0435\u043b\u044f\u043c \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":125663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-125662","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een serverul MCP GitHub, ce duce la scurgeri de informa\u021bii din repository-urile private | ProHoster","description":"Pe serverul MCP GitHub, implementarea protocolului MCP (Model Context Protocol) de la GitHub, a fost identificat\u0103 o vulnerabilitate care permite extragerea datelor din repository-urile private ale utilizatorilor care folosesc asisten\u021bi AI pentru automatizare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 MCP-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 GitHub, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 | ProHoster","og:description":"\u0412 GitHub MCP Server, \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 MCP (Model Context Protocol) \u043e\u0442 GitHub, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 AI-\u0430\u0441\u0441\u0438\u0441\u0442\u0435\u043d\u044b \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-28T13:05:18+00:00","article:modified_time":"2025-05-28T13:05:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"125662","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:02:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:02:24","updated":"2026-01-23 13:02:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/125662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=125662"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/125662\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/125663"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=125662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=125662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=125662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}