The vulnerability arises from improper control of code generation (CWE-94) in the GitHub Actions workflow file (.github/workflows/pr-docker-build.yml) used by the postiz-app. Specifically, an attacker can open a pull request from a fork containing a malicious Dockerfile.dev, which is executed during the Docker image build process. This execution allows arbitrary code execution and theft of a GITHUB_TOKEN with extensive privileges. The issue was fixed in commit da44801, which mitigates the risk by correcting the workflow to prevent untrusted code execution.

An unauthenticated attacker can execute arbitrary code in the context of the Docker build process and steal a GITHUB_TOKEN with write-all permissions. This token compromise can lead to full repository control, including code modification, deletion, and potentially further compromise of CI/CD pipelines or other integrated services. The vulnerability has a critical impact on confidentiality, integrity, and availability of the affected project.

This vulnerability has been patched by gitroomhq in commit da44801. Users should update to this commit or later versions to remediate the issue. Since the product is not a cloud service, remediation requires applying the patch to the affected workflow file. There is no indication of known exploits in the wild at this time.