Threats Tagged 'ghsa-2qvg-qr73-mqxp'
View all threats tagged with 'ghsa-2qvg-qr73-mqxp'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-2qvg-qr73-mqxp'
Click on any threat for detailed analysis and mitigation recommendations
conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target (CVE-2026-55158)CVE-2026-55158 0 Versions of wktk/conflibot prior to 1.2.1 are vulnerable to command injection via crafted pull request branch names when used in workflows triggered by the pull_request_target event. The vulnerability arises because git commands are constructed using string interpolation and executed through a shell, allowing attacker-controlled branch names containing shell metacharacters to execute arbitrary commands. This can lead to unauthorized access to repository secrets and tokens, enabling secret exfiltration and repository write access without maintainer interaction. The issue is fixed in versions 1.2.1 and 2.0.0 by avoiding shell command execution and referencing pull requests by number instead of branch name. Join the discussion | GCVE Database | 08/17/2026, 13:35:07 UTC Added: 08/17/2026, 16:14:12 UTC |
Showing 1 to 1 of 1 result