CVE-2026-44668 is a critical vulnerability in the factionsecurity faction product 'faction' prior to version 1.8.3. The issue arises because the AccessControlInterceptor, which is supposed to authenticate all Struts2 actions, does not verify session validity before invoking actions. Additionally, four methods in BoilerPlateConfig lack local session checks, allowing unauthenticated attackers to read, modify, deactivate, or delete boilerplate templates. This vulnerability has a CVSS score of 9.8, indicating a high risk of confidentiality, integrity, and availability impact. The vulnerability is fixed in version 1.8.3.
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.
FACTION versions prior to 1.8.3 are affected by a stored cross-site scripting (XSS) vulnerability in the remediation verification file preview feature. The vulnerability arises because attachment filenames supplied by users are stored and rendered without proper output encoding, allowing attacker-controlled JavaScript to execute in the browsers of users who view these files. This persistent XSS can impact privileged users and lead to high confidentiality and integrity risks. The issue is fixed in version 1.8.3.
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to version 1.7.1, an extension execution path in Faction’s extension framework permits untrusted extension code to execute arbitrary system commands on the server when a lifecycle hook is invoked, resulting in remote code execution (RCE) on the host running Faction. Due to a missing authentication check on the /portal/AppStoreDashboard endpoint, an attacker can access the extension management UI and upload a malicious extension without any authentication, making this vulnerability exploitable by unauthenticated users. This issue has been patched in version 1.7.1.
tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0
A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely.
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)