Command injection in MeltanoHub test_dispatcher GitHub Actions workflow (CVE-2026-47690)

The `test_dispatcher` GitHub Actions workflow in MeltanoHub unsafely interpolates attacker-controlled filenames into a shell command, enabling command injection. Because the workflow uses `pull_request_target`, it runs in the context of the base repository with access to secrets, allowing any GitHub user who opens a pull request from a fork to achieve arbitrary code execution on the runner and exfiltrate the write-scoped `GITHUB_TOKEN` and `MELTYBOT_GITHUB_AUTH_TOKEN`. Public POC available. Affected versions: - 71ab69a We recommend updating to: 923820d. CVSS 7.5 · our assessment: this_week Reference: https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w Details: https://vuln.today/cve/CVE-2026-47690