{"id":125662,"date":"2025-05-28T15:05:18","date_gmt":"2025-05-28T13:05:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev"},"modified":"2025-05-28T15:05:18","modified_gmt":"2025-05-28T13:05:18","slug":"uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-mcp-servere-github-privodyashhaya-k-utechke-informaczii-iz-privatnyh-repozitoriev","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb serverin MCP t\u00eb GitHub, q\u00eb \u00e7on n\u00eb rrjedhjen e informacionit nga repozitat privat.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb serverin MCP t\u00eb GitHub, realizimi i protokollit MCP (Protokolli i Kontekstit Model) nga GitHub, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi q\u00eb lejon nxjerrjen e t\u00eb dh\u00ebnave nga repozitat private t\u00eb p\u00ebrdoruesve, q\u00eb p\u00ebrdorin ndihm\u00ebs AI p\u00ebr automatizimin e pun\u00ebs me repozitat. <\/p>\n
Protokolli MCP \u00ebsht\u00eb krijuar p\u00ebr t\u00eb lidhur modelet AI me burime t\u00eb ndryshme t\u00eb t\u00eb dh\u00ebnave. Serveri MCP i GitHub ofron nj\u00eb integrim pa nd\u00ebrprerje t\u00eb modeleve t\u00eb m\u00ebdha t\u00eb gjuh\u00ebs me API-n\u00eb e GitHub dhe i jep k\u00ebtyre modeleve kontekst t\u00eb shtuar, duke nxjerr\u00eb t\u00eb dh\u00ebna nga repozitat GitHub. Modelet q\u00eb p\u00ebrdorin MCP mund t\u00eb p\u00ebrdoren p\u00ebr automatizimin e veprimeve t\u00eb caktuara me GitHub, si p\u00ebr shembull, p\u00ebr analizimin e mesazheve t\u00eb gabimeve. <\/p>\n
The essence of the vulnerability is that through interaction with a large language model connected to GitHub, confidential user data linked to their GitHub account can be disclosed. An attacker can place a specially crafted issue report in a public repository, which utilizes automation based on the large language model. Once activated, the model will generate a pull request with a proposed solution. Accordingly, if the issue concerns private repositories or sensitive data, the model may reveal information in the suggested pull request.
<\/center> <\/p>\n
Si p\u00ebr shembull, u d\u00ebrgua nj\u00eb mesazh gabimi me nj\u00eb ankes\u00eb se autori nuk ishte i specifikuar n\u00eb sked\u00ebn README. Si zgjidhje, n\u00eb mesazh u propozua t\u00eb shtohej informata mbi autorin n\u00eb README, si dhe lista e t\u00eb gjitha repozitoreve me t\u00eb cilat ka punuar autori. Si rezultat, modeli krijoi nj\u00eb pull-request me informacionin q\u00eb p\u00ebrfshinte informacion personal mbi autorin, e cila u nxor nga nj\u00eb repozitor privat, si dhe list\u00ebn e repozitoreve privat\u00eb ekzistues. N\u00eb faz\u00ebn e ardhshme, p\u00ebrmes nj\u00eb bashk\u00ebpunimi t\u00eb ngjash\u00ebm me modelin, mund t\u00eb fitohet edhe t\u00eb dh\u00ebna nga nj\u00eb repozitor privat specifik. <\/p>\n
P\u00ebr aktivizimin e AI-agjentit, \u00ebsht\u00eb e nevojshme q\u00eb pronari i repository-t t\u00eb jap\u00eb urdh\u00ebr p\u00ebr analizimin e mesazheve t\u00eb gabimeve. N\u00eb rast se GitHub \u00ebsht\u00eb i lidhur me sh\u00ebrbimin AI Claude, \u00ebsht\u00eb e mjaftueshme q\u00eb pronari i repository-t t\u00eb d\u00ebrgoj\u00eb AI-asistentit nj\u00eb k\u00ebrkes\u00eb si «shiko problematikat n\u00eb repository-t e mia me kod t\u00eb hapur dhe njihu me to». Pas k\u00ebsaj, AI-asistenti do t\u00eb angazhoj\u00eb integrimin MCP t\u00eb konfiguruesh\u00ebm me llogarin\u00eb n\u00eb GitHub dhe do t\u00eb zbatoj\u00eb instrukcionet e p\u00ebrfshira n\u00eb mesazhet e problemeve. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Nj\u00eb](\"\/wp-content\/uploads\/2025\/05\/d90869cf9ba87f9fe8691181c703288f.png\")
<\/center> <\/p>\n