OWASP BLT versions before 2.1.2 contain a code injection vulnerability (CWE-94) due to the use of the pull_request_target GitHub Actions trigger in the .github/workflows/pre-commit-fix.yaml workflow. This trigger runs with elevated privileges but checks out and executes code from the attacker's fork repository without proper validation, allowing an attacker to execute arbitrary code remotely with write access. The issue is resolved in version 2.1.2 of OWASP BLT.

Successful exploitation allows an attacker to achieve remote code execution with write permissions on the affected system. This can lead to full compromise of the environment where the workflow runs, including unauthorized code execution and potential further attacks. The CVSS v3.1 score is 8.8 (high), reflecting the network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade OWASP BLT to version 2.1.2 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.1.2, applying this update fully mitigates the risk. No additional mitigations are specified or required beyond upgrading.