CVE-2026-44359: CWE-94: Improper Control of Generation of Code ('Code Injection') in meshtastic firmware
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
AI Analysis
Technical Summary
The Meshtastic firmware repository's GitHub Actions workflow (main_matrix.yml) prior to version 2.7.21.1370b23 is vulnerable to code injection due to improper control over execution of code from external pull request forks. The workflow triggers on pull_request_target and runs multiple jobs that check out and execute code from the attacker's fork with access to repository secrets and elevated GITHUB_TOKEN permissions, without any approval gate. This allows an attacker with an external fork and author_association "NONE" to execute arbitrary code in the CI environment, potentially compromising the supply chain, self-hosted runners, or the repository itself. This vulnerability is distinct from a previously fixed command injection issue (GHSA-6mwm-v2vv-pp96) and was addressed by patching in version 2.7.21.1370b23.
Potential Impact
An attacker can execute arbitrary code within the CI environment with elevated permissions, leading to potential compromise of repository secrets, supply chain integrity, self-hosted runners, and repository takeover. The vulnerability has a CVSS score of 10.0, indicating critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact.
Mitigation Recommendations
Version 2.7.21.1370b23 of Meshtastic firmware contains a patch that addresses this vulnerability. Users should upgrade to this version or later to remediate the issue. No other official remediation details are provided; therefore, patching to the fixed version is the recommended action. Patch status is not yet confirmed beyond the stated fixed version; check the vendor advisory for current remediation guidance.
CVE-2026-44359: CWE-94: Improper Control of Generation of Code ('Code Injection') in meshtastic firmware
Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
CVSS v3.1
Score 10.0critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Meshtastic firmware repository's GitHub Actions workflow (main_matrix.yml) prior to version 2.7.21.1370b23 is vulnerable to code injection due to improper control over execution of code from external pull request forks. The workflow triggers on pull_request_target and runs multiple jobs that check out and execute code from the attacker's fork with access to repository secrets and elevated GITHUB_TOKEN permissions, without any approval gate. This allows an attacker with an external fork and author_association "NONE" to execute arbitrary code in the CI environment, potentially compromising the supply chain, self-hosted runners, or the repository itself. This vulnerability is distinct from a previously fixed command injection issue (GHSA-6mwm-v2vv-pp96) and was addressed by patching in version 2.7.21.1370b23.
Potential Impact
An attacker can execute arbitrary code within the CI environment with elevated permissions, leading to potential compromise of repository secrets, supply chain integrity, self-hosted runners, and repository takeover. The vulnerability has a CVSS score of 10.0, indicating critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact.
Mitigation Recommendations
Version 2.7.21.1370b23 of Meshtastic firmware contains a patch that addresses this vulnerability. Users should upgrade to this version or later to remediate the issue. No other official remediation details are provided; therefore, patching to the fixed version is the recommended action. Patch status is not yet confirmed beyond the stated fixed version; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-05T20:15:20.630Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5d5d552a4a8d59895cdb38
Added to database: 07/19/2026, 23:27:17 UTC
Last enriched: 07/19/2026, 23:41:40 UTC
Last updated: 07/20/2026, 20:09:49 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.