A tracked embargo state file pre-seeds a new embargo store, letting a planted entry exempt an advisory from the check

A tracked embargo state file pre-seeds a new embargo store, letting a planted entry exempt an advisory from the check

Published as security advisory GHSA-gm2q-5m8j-4cx6; the advisory is the public account of this finding.

What

The embargo store is created with git worktree add --detach <store> <default-branch tip> (internal/core/embargo/store.go:257-289), and its state lives at .abcd/.work.local/embargo/state.json inside that worktree (internal/core/embargo/state.go:28). That path is gitignored, but a tracked file is still checked out. A contributor whose commit lands on the default branch can force-add a state.json there. The owner's first embargo intake then creates the store with that file already present, written by git as the owner at 0644, which passes the owner check. Verify refuses tracked ledger records (refuseTracked) but does not ask whether the state file itself is tracked, so the planted state is accepted as the store's own.

An entry naming a real advisory id with published_at or an ending verdict survives intake (refreshHeld clears neither, intake.go:147-217). That advisory then gets no private record, and embargo check lets its id and title through (check.go:614-616, :691). A malformed planted state fails closed (the check refuses in every repository under that home).

Preconditions narrow it: commit access to the default branch, knowledge of an unpublished advisory id before the owner's first intake (in practice only that advisory's reporter), and only the first store creation is affected, since the union across stores treats an id unpublished in any store as unpublished. Found from code; not reproduced.

Affected versions

Every released version up to and including 0.15.1 with the embargo store. Patched versions will be set when the release carrying the fix is cut.

Would it exist without abcd?

No. The store and its state file exist only because of abcd, and so does the check that trusts it. abcd added it, so abcd fixes it.

Fix

Refuse a state file the store's index tracks, as tracked ledger records already are, or remove the state path from the worktree immediately after worktree add and before the first load. No repository behaviour changes.