What is the CVSS score of CVE-2026-1699?

CVE-2026-1699 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-1699?

A critical vulnerability in Eclipse Theia's GitHub Actions workflow allows attackers to execute arbitrary code in the CI/CD pipeline through malicious pull requests, potentially compromising source…

Is there a public PoC exploit available for CVE-2026-1699?

Yes, a public proof-of-concept exploit is available for CVE-2026-1699. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1699?

Within 24 hours: Immediately disable or restrict the affected preview.yml workflow to trusted contributors only; audit recent pull requests and GitHub Actions logs for suspicious activity; revoke any exposed credentials or tokens. Within 7 days: Implement mandatory code review requirements for all pull requests before merge; enable branch protection rules; conduct forensic analysis of workflow execution history. Within 30 days: Migrate to a patched version when available; implement separate CI/CD credentials with minimal privileges; deploy additional monitoring on GitHub Actions activity.

Github CVE-2026-1699

CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-01-30 emo@eclipse.org

Github Theia Website Eclipse

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Mar 10, 2026 - 18:23 vuln.today

Public exploit code

CVE Published

Jan 30, 2026 - 10:15 nvd

CRITICAL 10.0

DescriptionCVE.org

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.

AnalysisAI

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available.

Technical ContextAI

CWE-829 in GitHub Actions. pull_request_target trigger runs in base repo context while checking out PR code, exposing repository secrets.

RemediationAI

Fix GitHub Actions workflow to not checkout PR code with pull_request_target.

More in Github

View all

CVE-2026-27941 CRITICAL Act Now POC

9.9 Feb 26

Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma

CVE-2026-22869 CRITICAL Act Now POC

9.8 Jan 13

Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a

CVE-2024-0200 CRITICAL Act Now POC

9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R

CVE-2022-24724 CRITICAL Act Now POC

9.8 Mar 03

cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Rated critical severity (CVSS 9.

CVE-2024-9487 CRITICAL Act Now POC

9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe

CVE-2026-28215 CRITICAL Act Now POC

9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit

CVE-2018-1000600 HIGH This Week POC

8.8 Jun 26

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede

CVE-2026-30920 HIGH This Week POC

8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by

CVE-2026-25221 HIGH This Week POC

8.1 Feb 02

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab

CVE-2026-23644 HIGH This Week POC

7.5 Jan 18

Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers

CVE-2024-42471 HIGH This Week POC

7.5 Sep 02

actions/artifact is the GitHub ToolKit for developing GitHub Actions. Rated high severity (CVSS 7.5), this vulnerability

CVE-2023-37463 HIGH This Week POC

7.5 Jul 13

cmark-gfm is an extended version of the C reference implementation of CommonMark, a rationalized version of Markdown syn

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all

CVE-2025-32463 CRITICAL POC

9.3

CVE-2026-0770 CRITICAL POC

9.8

CVE-2025-27607 HIGH POC

8.8

CVE-2026-27941 CRITICAL POC

9.9

CVE-2020-8128 CRITICAL POC

9.8

CVE-2019-13589 CRITICAL POC

9.8

CVE-2018-15486 CRITICAL POC

9.1

CVE-2021-30507 HIGH POC

8.8

CVE-2026-1699 vulnerability details – vuln.today

Back

Github CVE-2026-1699

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Github

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

Share

External POC / Exploit Code