Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/mattermost/mattermost-plugin-github < 1.0.1-0.20260318132218-6e6b740c4852
Fixed in
1.0.1-0.20260318132218-6e6b740c4852· Vendor fix available
Issue
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL. Mattermost Advisory ID: MMSA-2026-00628
Recommended action: Upgrade to 1.0.1-0.20260318132218-6e6b740c4852 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-github < 1.0.1-0.20260330164815-c2840e980b3c
Fixed in
1.0.1-0.20260330164815-c2840e980b3c· Vendor fix available
Issue
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638
Recommended action: Upgrade to 1.0.1-0.20260330164815-c2840e980b3c (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-github < 1.0.1-0.20260410143745-9b41b1fd43c4
Fixed in
1.0.1-0.20260410143745-9b41b1fd43c4· Vendor fix available
Issue
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which allows an attacker to cause a denial of service via crafted oversized HTTP requests.. Mattermost Advisory ID: MMSA-2026-00646
Recommended action: Upgrade to 1.0.1-0.20260410143745-9b41b1fd43c4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/mattermost/mattermost-plugin-github < 1.0.1-0.20250829075715-0deffcfc6bee
Fixed in
1.0.1-0.20250829075715-0deffcfc6bee· Vendor fix available
Issue
Mattermost versions 10.11.x <= 10.11.6 and Mattermost GitHub plugin versions <=2.4.0 fail to validate plugin bot identity in reaction forwarding which allows attackers to hijack the GitHub reaction feature to make users add reactions to arbitrary GitHub objects via crafted notification posts.
Recommended action: Upgrade to 1.0.1-0.20250829075715-0deffcfc6bee (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.