Eigent
CVE-2026-22869
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate malicious fork of repository
-
DeliverySubmit pull request with crafted workflow code
-
ExploitTrigger pull_request_target event
-
ExecutionExecute arbitrary code in CI environment
-
ImpactSteal repository credentials and push malicious code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | GitHub repository using pull_request_target trigger in CI workflow (.github/workflows/ci.yml) that checks out untrusted pull request code without restrictions. No authentication required; any user can fork the repository and submit a pull request. |
| Impact | CVSS 9.8 (Critical). No auth (anyone can create a fork PR), scope change. PoC available. This is a supply chain attack vector affecting all users of the project. EPSS 0.15%. Patch available. |
| Exploit ScenarioDerived | An attacker forks the repo, modifies CI scripts to exfiltrate repository secrets, and opens a PR. The CI runs their code with full repository access, leaking signing keys and deployment credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling arbitrary code execution with repository write permissions from fork PRs. PoC available, patch available.
Earlier versions of this analysis (1)
Eigent CI workflow allows fork PRs to execute arbitrary code with repository write permissions.
RemediationAI
Update the CI workflow. Never checkout untrusted PR code in pull_request_target workflows.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The GitHub Actions workflow uses pull_request_target trigger and checks out the PR's head code (CWE-94). Fork PRs run with the base repository's secrets and write permissions, allowing an attacker to steal credentials, push code, and create releases.
Know when Eigent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pull_request_target trigger combined with checkout of untrusted PR code. An attacker can exploit this to steal credentials, post comments, push code, or create releases.
Executive ViewAI
Organizations using Eigent face critical risk from CVE-2026-22869, a code injection vulnerability rated CVSS 9.8. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB