Radicle, a peer-to-peer code collaboration platform, disclosed two critical vulnerabilities in its network protocol: unencrypted network traffic allowing data interception, and broken peer authentication enabling node impersonation. All released versions are affected; users are advised to stop using private repositories until a fix is released, which will require a major version bump due to incompatibility.
Radicle's peer-to-peer code forge sends private repositories and metadata in unencrypted cleartext over TCP after its initial Noise handshake, exposing sensitive data to network intermediaries. This vulnerability affects all releases through version 1.10.3 and requires users to tunnel connections through VPNs or other encrypted channels for protection.