The vulnerability in classroom50 (CVE-2026-94620) is an improper limitation of pathname to a restricted directory (CWE-22) that allows arbitrary file write via symlink following. The `gh teacher download` command clones student assignment repositories and writes autograde artifacts (`result.json` and `results.json`) into the cloned working tree. If these files are symlinks, the tool writes to the symlink target paths, which can be arbitrary files such as shell configuration files, SSH authorized keys, cron files, or Git hooks. The attacker controls the content written, enabling code execution as the teacher. The teacher's `gh` token has broad privileges including `admin:org`, `repo`, and `workflow`. The issue is patched in version 1.11.0. Mitigations include sandboxing and manual inspection of cloned repositories.

Successful exploitation allows an attacker (a student) to write arbitrary files on the teacher's system with the privileges of the teacher user. This can lead to code execution, unauthorized modification of sensitive files, and compromise of the teacher's GitHub organization credentials and workflows. The vulnerability is critical with a CVSS 4.0 score of 9.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, availability, and security requirements.

Version 1.11.0 of classroom50 contains an official patch that fixes this vulnerability. Users should upgrade to version 1.11.0 or later. Until patched, avoid running `gh teacher download` on untrusted student repositories. If necessary, run the command inside a disposable sandbox or container that restricts access to sensitive host files and credentials. Additionally, inspect cloned repositories for symlinked, hardlinked, or special files named `result.json` or `results.json` before proceeding with artifact writes.