CVE-2026-44359: CWE-94: Improper Control of Generation of Code ('Code Injection') in meshtastic firmware
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
AI Analysis
Technical Summary
The Meshtastic firmware's GitHub Actions workflow (main_matrix.yml) prior to version 2.7.21.1370b23 improperly handled pull_request_target events by checking out and executing code from untrusted external forks without any approval gate. This allowed attackers submitting pull requests with author_association "NONE" to execute arbitrary code with elevated GITHUB_TOKEN permissions and access to repository secrets. This vulnerability is a form of code injection (CWE-94) and improper control of resource consumption (CWE-829). The flaw could enable supply chain compromise, self-hosted runner compromise, or full repository takeover. The vulnerability was fixed in version 2.7.21.1370b23 by patching the workflow to prevent execution of attacker-controlled code.
Potential Impact
An attacker could exploit this vulnerability by submitting a pull request from an external fork, causing the CI workflow to execute malicious code with elevated privileges and access to repository secrets. This could lead to supply chain compromise, compromise of self-hosted runners, or takeover of the repository. The CVSS score is 10.0 (critical), reflecting the high impact on confidentiality and integrity with no required privileges or user interaction.
Mitigation Recommendations
Version 2.7.21.1370b23 of Meshtastic firmware contains a patch that fixes this vulnerability by preventing execution of attacker-controlled code in the CI workflow. Users and maintainers should upgrade to this version or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-44359: CWE-94: Improper Control of Generation of Code ('Code Injection') in meshtastic firmware
Description
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.
CVSS v3.1
Score 10.0critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Meshtastic firmware's GitHub Actions workflow (main_matrix.yml) prior to version 2.7.21.1370b23 improperly handled pull_request_target events by checking out and executing code from untrusted external forks without any approval gate. This allowed attackers submitting pull requests with author_association "NONE" to execute arbitrary code with elevated GITHUB_TOKEN permissions and access to repository secrets. This vulnerability is a form of code injection (CWE-94) and improper control of resource consumption (CWE-829). The flaw could enable supply chain compromise, self-hosted runner compromise, or full repository takeover. The vulnerability was fixed in version 2.7.21.1370b23 by patching the workflow to prevent execution of attacker-controlled code.
Potential Impact
An attacker could exploit this vulnerability by submitting a pull request from an external fork, causing the CI workflow to execute malicious code with elevated privileges and access to repository secrets. This could lead to supply chain compromise, compromise of self-hosted runners, or takeover of the repository. The CVSS score is 10.0 (critical), reflecting the high impact on confidentiality and integrity with no required privileges or user interaction.
Mitigation Recommendations
Version 2.7.21.1370b23 of Meshtastic firmware contains a patch that fixes this vulnerability by preventing execution of attacker-controlled code in the CI workflow. Users and maintainers should upgrade to this version or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-05T20:15:20.630Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5d5d552a4a8d59895cdb38
Added to database: 07/19/2026, 23:27:17 UTC
Last enriched: 07/30/2026, 03:52:06 UTC
Last updated: 08/16/2026, 12:41:09 UTC
Views: 135
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.