It actually looks like the vulnerability is on Rails itself, which Github is built on...