Cloudflare pages-action CVE-2026-11325

Exploitation requires that the target repository uses cloudflare/pages-action in a GitHub Actions workflow that processes external input - specifically, workflows triggered by pull_request or similar events that incorporate attacker-controlled data (branch names, PR titles, commit messages) into shell command execution paths within src/index.ts. The CVSS vector UI:R indicates a workflow run must be triggered, meaning a maintainer action (approving a PR run, manually triggering the pipeline) or an auto-trigger configuration is required. PR:N confirms no prior authentication or repository access is needed from the attacker's side - submitting a public pull request is sufficient. Exploitation is limited to repositories that have not yet migrated to cloudflare/wrangler-action, and to workflow configurations that expose untrusted external input to the action's execution context. Repositories using pages-action only in push-triggered workflows without external input are at materially lower risk.

The provided CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity network-reachable flaw requiring no privilege but requiring user interaction - consistent with a workflow-trigger model where a maintainer must run the CI pipeline. The real-world risk is compounded by several factors: secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN have broad blast radius (full account API access and repository write access, respectively), and the product will receive zero security patches by vendor declaration. There is no CISA KEV listing and no confirmed public POC, so exploitation is not yet confirmed as active or widespread. However, the HackerOne disclosure and two credited researchers indicate the vulnerability is reproducible. The critical operational risk is the hard deprecation deadline: the action will be forcibly removed on 2026-09-18, causing CI/CD disruption for non-migrated consumers independent of exploitation. EPSS data is not provided; given the niche GitHub Actions ecosystem footprint, widespread automated scanning is unlikely, but targeted attacks against high-value repositories are plausible.

An external contributor opens a pull request to a target repository with a crafted branch name or PR metadata containing shell metacharacters. A maintainer triggers the CI/CD pipeline (or a workflow is configured to run automatically on pull_request events), causing the pages-action step in src/index.ts to process the attacker-controlled input and execute injected OS commands within the runner environment. The injected command exfiltrates CLOUDFLARE_API_TOKEN and GITHUB_TOKEN from the workflow environment variables to an attacker-controlled endpoint, granting full API access to the victim's Cloudflare account and repository.