conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target (CVE-2026-55158)
Versions of wktk/conflibot prior to 1.2.1 are vulnerable to command injection via crafted pull request branch names when used in workflows triggered by the pull_request_target event. The vulnerability arises because git commands are constructed using string interpolation and executed through a shell, allowing attacker-controlled branch names containing shell metacharacters to execute arbitrary commands. This can lead to unauthorized access to repository secrets and tokens, enabling secret exfiltration and repository write access without maintainer interaction. The issue is fixed in versions 1.2.1 and 2.0.0 by avoiding shell command execution and referencing pull requests by number instead of branch name.
AI Analysis
Technical Summary
wktk/conflibot versions before 1.2.1 build git commands via string interpolation and execute them through a shell, interpolating attacker-controlled pull request branch names. When run on the pull_request_target event, the workflow has access to repository secrets and a write-scoped GITHUB_TOKEN. An attacker can craft a pull request with a branch name containing shell metacharacters to execute arbitrary commands on the runner with these elevated privileges. This allows exfiltration of secrets and token abuse without any special privileges or maintainer interaction. The vulnerability is fixed in versions 1.2.1 and 2.0.0 by switching to argument arrays for git commands and referencing pull requests by number, preventing shell interpretation of branch names.
Potential Impact
An attacker can achieve arbitrary command execution on the GitHub Actions runner with access to repository secrets and a write-scoped GITHUB_TOKEN. This enables exfiltration of sensitive information and unauthorized repository modifications. The vulnerability requires no special privileges or maintainer interaction and is exploitable by simply opening a crafted pull request. The CVSS score is 9.1 (critical), reflecting the high impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade wktk/conflibot to version 1.2.1 or later (including 2.0.0). These versions fix the vulnerability by avoiding shell command execution and referencing pull requests by number rather than branch name. There is no configuration-only workaround for affected versions. On GitHub-hosted runners, upgrading to wktk/conflibot@v2 is a drop-in replacement. Self-hosted runners require Node.js 24 support and git 2.38 or later to upgrade safely.
conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target (CVE-2026-55158)
Description
Versions of wktk/conflibot prior to 1.2.1 are vulnerable to command injection via crafted pull request branch names when used in workflows triggered by the pull_request_target event. The vulnerability arises because git commands are constructed using string interpolation and executed through a shell, allowing attacker-controlled branch names containing shell metacharacters to execute arbitrary commands. This can lead to unauthorized access to repository secrets and tokens, enabling secret exfiltration and repository write access without maintainer interaction. The issue is fixed in versions 1.2.1 and 2.0.0 by avoiding shell command execution and referencing pull requests by number instead of branch name.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
wktk/conflibot versions before 1.2.1 build git commands via string interpolation and execute them through a shell, interpolating attacker-controlled pull request branch names. When run on the pull_request_target event, the workflow has access to repository secrets and a write-scoped GITHUB_TOKEN. An attacker can craft a pull request with a branch name containing shell metacharacters to execute arbitrary commands on the runner with these elevated privileges. This allows exfiltration of secrets and token abuse without any special privileges or maintainer interaction. The vulnerability is fixed in versions 1.2.1 and 2.0.0 by switching to argument arrays for git commands and referencing pull requests by number, preventing shell interpretation of branch names.
Potential Impact
An attacker can achieve arbitrary command execution on the GitHub Actions runner with access to repository secrets and a write-scoped GITHUB_TOKEN. This enables exfiltration of sensitive information and unauthorized repository modifications. The vulnerability requires no special privileges or maintainer interaction and is exploitable by simply opening a crafted pull request. The CVSS score is 9.1 (critical), reflecting the high impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade wktk/conflibot to version 1.2.1 or later (including 2.0.0). These versions fix the vulnerability by avoiding shell command execution and referencing pull requests by number rather than branch name. There is no configuration-only workaround for affected versions. On GitHub-hosted runners, upgrading to wktk/conflibot@v2 is a drop-in replacement. Self-hosted runners require Node.js 24 support and git 2.38 or later to upgrade safely.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2qvg-qr73-mqxp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55158"]
- Ecosystems
- ["GitHub Actions"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a833354bf8831d5392a4df5
Added to database: 08/17/2026, 16:14:12 UTC
Last enriched: 08/17/2026, 16:27:51 UTC
Last updated: 08/18/2026, 01:04:53 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.