CVE-2026-55675: CWE-94: Improper Control of Generation of Code ('Code Injection') in saltyorg docs

The saltyorg docs repository's GitHub Actions workflows previously allowed code injection via untrusted fork commits in pull requests. Specifically, the trigger-pr-build.yml workflow recorded the fork commit in an artifact, and the build-pr.yml workflow checked out that commit before running pip install. This allowed an attacker controlling the fork to supply malicious setup.py or PEP 517 build hooks that executed with elevated privileges, including access to sensitive tokens such as CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN. The vulnerability was not due to the repository-fork guard but due to the execution of attacker-controlled code in the privileged workflow environment. The issue was resolved by commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

Successful exploitation allows an attacker to execute arbitrary code in the context of the repository's privileged GitHub Actions workflow, leading to disclosure of sensitive secrets and potential full compromise of the repository and its resources. The CVSS score is 10.0 (critical), indicating maximum impact on confidentiality, integrity, and availability.

This vulnerability has been fixed by commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. Users should update their workflows to include this fix. No further action is required if this commit or a later version is applied.