What is the CVSS score of CVE-2026-1699?

CVE-2026-1699 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-1699?

A critical vulnerability in Eclipse Theia's GitHub Actions workflow allows attackers to execute arbitrary code in the CI/CD pipeline through malicious pull requests, potentially compromising source…

Is there a public PoC exploit available for CVE-2026-1699?

Yes, a public proof-of-concept exploit is available for CVE-2026-1699. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1699?

Within 24 hours: Immediately disable or restrict the affected preview.yml workflow to trusted contributors only; audit recent pull requests and GitHub Actions logs for suspicious activity; revoke any exposed credentials or tokens. Within 7 days: Implement mandatory code review requirements for all pull requests before merge; enable branch protection rules; conduct forensic analysis of workflow execution history. Within 30 days: Migrate to a patched version when available; implement separate CI/CD credentials with minimal privileges; deploy additional monitoring on GitHub Actions activity.

Github CVE-2026-1699

CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-01-30 emo@eclipse.org

Github Theia Website

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Mar 10, 2026 - 18:23 vuln.today

Public exploit code

CVE Published

Jan 30, 2026 - 10:15 nvd

CRITICAL 10.0

DescriptionCVE.org

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.

AnalysisAI

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. CVSS 10.0, PoC available.

Technical ContextAI

CWE-829 in GitHub Actions. pull_request_target trigger runs in base repo context while checking out PR code, exposing repository secrets.

RemediationAI

Fix GitHub Actions workflow to not checkout PR code with pull_request_target.

More in Github

View all

CVE-2026-27941 CRITICAL Act Now POC

9.9 Feb 26

Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma

CVE-2026-22869 CRITICAL Act Now POC

9.8 Jan 13

Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a

CVE-2026-28215 CRITICAL Act Now POC

9.1 Feb 26

Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit

CVE-2018-1000600 HIGH This Week POC

8.8 Jun 26

A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede

CVE-2026-30920 HIGH This Week POC

8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by

CVE-2026-25221 HIGH This Week POC

8.1 Feb 02

PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab

CVE-2026-23644 HIGH This Week POC

7.5 Jan 18

Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers

CVE-2025-68619 HIGH This Week POC

7.2 Jan 01

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore i

CVE-2026-27943 MEDIUM This Month POC

6.5 Feb 26

Authenticated users in OpenEMR through version 8.0.0 can access and modify eye exam records belonging to other patients

CVE-2026-23889 MEDIUM This Month POC

6.5 Jan 26

Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire

CVE-2026-27612 MEDIUM This Month POC

6.1 Feb 25

Reflected XSS in Repostat's RepoCard React component prior to version 1.0.1 allows attackers to execute arbitrary JavaSc

CVE-2025-49013 CRITICAL Act Now

9.9 Jun 09

A security vulnerability in WilderForge (CVSS 9.9). Critical severity with potential for significant impact on affected

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all

CVE-2025-32463 CRITICAL POC

9.3

CVE-2026-0770 CRITICAL POC

9.8

CVE-2025-27607 HIGH POC

8.8

CVE-2026-27941 CRITICAL POC

9.9

CVE-2020-8128 CRITICAL POC

9.8

CVE-2019-13589 CRITICAL POC

9.8

CVE-2018-15486 CRITICAL POC

9.1

CVE-2021-30507 HIGH POC

8.8

CVE-2026-1699 vulnerability details – vuln.today

Back

Github CVE-2026-1699

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Github

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

Share

External POC / Exploit Code