CVE-2026-42603

OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target

State: Published
Severity: 8.8 High
Published: May 11, 2026
Updated: May 11, 2026
Reserved: Apr 29, 2026

Description

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Affected Products

Product	Versions
BLTOWASP-BLT	< 2.1.2Affected

References

https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-cgvj-qg2h-cqfh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.