The flaw allows an unauthenticated attacker to craft a GitHub Issue in an org's public repository and then silently pull data from its private repos, too.
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows
Résumé + lien vers la source. Sans paywall, sans tracking.