What is the CVSS score of CVE-2026-1699?

CVE-2026-1699 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-1699?

A critical vulnerability in Eclipse Theia's GitHub Actions workflow allows attackers to execute arbitrary code in the CI/CD pipeline through malicious pull requests, potentially compromising source…

Is there a public PoC exploit available for CVE-2026-1699?

Yes, a public proof-of-concept exploit is available for CVE-2026-1699. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1699?

Within 24 hours: Immediately disable or restrict the affected preview.yml workflow to trusted contributors only; audit recent pull requests and GitHub Actions logs for suspicious activity; revoke any exposed credentials or tokens. Within 7 days: Implement mandatory code review requirements for all pull requests before merge; enable branch protection rules; conduct forensic analysis of workflow execution history. Within 30 days: Migrate to a patched version when available; implement separate CI/CD credentials with minimal privileges; deploy additional monitoring on GitHub Actions activity.

Github CVE-2026-1699

CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-01-30 emo@eclipse.org

Github Theia Website

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Mar 10, 2026 - 18:23 vuln.today

Public exploit code

CVE Published

Jan 30, 2026 - 10:15 nvd

CRITICAL 10.0

DescriptionCVE.org

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.

AnalysisAI

Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target with checkout, enabling malicious PRs to steal secrets. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Create malicious pull request

Delivery

GitHub Actions workflow checks out untrusted code

Exploit

Arbitrary code executes in CI environment

Execution

Access repository secrets and GITHUB_TOKEN

Impact

Exfiltrate credentials and modify repository

Access

Create malicious pull request

Delivery

GitHub Actions workflow checks out untrusted code

Exploit

Arbitrary code executes in CI environment

Execution

Access repository secrets and GITHUB_TOKEN

Impact

Exfiltrate credentials and modify repository

Vulnerability AssessmentAI

Exploitation	Eclipse Theia GitHub repository with .github/workflows/preview.yml using pull_request_target trigger without code review gates. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Attacker submits malicious PR that modifies CI scripts, which execute in the Theia repo context with access to signing keys and deployment secrets.
Remediation	Fix GitHub Actions workflow to not checkout PR code with pull_request_target. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Immediately disable or restrict the affected preview.yml workflow to trusted contributors only; audit recent pull requests and GitHub Actions logs for suspicious activity; revoke any exposed credentials or tokens. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-1699 vulnerability details – vuln.today

Back

Github CVE-2026-1699

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code