Threats affecting pkg:pypi/otterdog

CVE-2026-123870 is a critical vulnerability in the Eclipse Foundation's otterdog web application. The vulnerability arises because the application uses Python's eval() function to process a format-string constructed from incoming GitHub webhook JSON data. If the GITHUB_WEBHOOK_SECRET configuration is unset or empty, the application skips the HMAC signature verification, allowing unauthenticated attackers to send malicious input that is evaluated by Python, leading to arbitrary code execution on the host.