PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7794 Sociomantic CVE debrief

CVE-2016-7794 is a critical remote code execution vulnerability in sociomantic-tsunami git-hub affecting versions through 0.10.2. The supplied description says a remote attacker can execute arbitrary code by using a crafted repository name. Because the issue is network-reachable and requires no user interaction, it should be treated as an emergency for any exposed deployment.

Vendor
Sociomantic
Product
Git-Hub
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-19
Original CVE updated
2026-05-13
Advisory published
2017-01-19
Advisory updated
2026-05-13

Who should care

Administrators, developers, and platform owners running sociomantic-tsunami git-hub, especially any instance that accepts repository names from untrusted or externally supplied input.

Technical summary

The supplied NVD record classifies this issue as CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-284 (Improper Access Control). NVD lists sociomantic git-hub as vulnerable through version 0.10.2, while the supplied title/description indicate the problem is fixed in 0.10.3. The reference set includes an OSS Security mailing-list post, a SecurityFocus entry, and a GitHub issue tracker item.

Defensive priority

Critical — prioritize immediate upgrade or removal from exposed service paths.

Recommended defensive actions

  • Upgrade sociomantic-tsunami git-hub to 0.10.3 or later as soon as possible.
  • Inventory all deployments and embedded uses of git-hub to confirm no vulnerable 0.10.2-or-earlier instances remain.
  • If immediate upgrade is not possible, limit network exposure and restrict who can submit repository names to the service.
  • Review logs and automation for unusual repository-name activity, especially around any untrusted input paths.
  • If compromise is suspected, treat the host as potentially affected and perform a full incident review before returning it to service.

Evidence notes

Evidence is drawn from the supplied NVD record and linked references. The NVD CVSS vector is 9.8/critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the vulnerable CPE range ends at 0.10.2. The supplied title/description state that versions before 0.10.3 are affected. The reference list also shows an OSS Security mailing-list disclosure, a SecurityFocus entry, and a GitHub issue tracker reference. No KEV entry is present in the supplied data.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7794 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7794

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7794 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7794

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.