The vulnerability in OmniBlocks monorepo involves the GitHub Actions workflow (.github/workflows/disc.yml) that triggers on issues opened and edited events. When an issue is classified as off-topic, the workflow invokes the createDiscussion mutation without tracking whether the issue has already been converted or suppressing duplicate runs. This allows a user to cause multiple discussions for the same issue by repeatedly editing the issue description before the conversion process completes, resulting in discussion spam. The problem was resolved by a commit (627e0f0a16a7d74b09128106b57dd7e85d2545df) that implements proper control to prevent duplicate discussion creation.

The vulnerability can cause multiple duplicate discussions to be created for a single off-topic issue, leading to discussion spam and additional moderation effort. There is no indication of privilege escalation, data leakage, or system compromise. The CVSS 4.0 score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and limited impact on integrity and availability.

A fix is available and was applied in the commit 627e0f0a16a7d74b09128106b57dd7e85d2545df on June 6, 2026. Users of the OmniBlocks monorepo should update to the version including this commit to prevent duplicate discussion creation. No additional mitigation steps are indicated.