What is the CVSS score of CVE-2026-31852?

CVE-2026-31852 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of iOS are affected by CVE-2026-31852?

A critical vulnerability in the Jellyfin iOS GitHub Actions workflow allows attackers to execute arbitrary code through pull requests from forked repositories, potentially compromising the integrity…

How to fix or mitigate CVE-2026-31852?

Within 24 hours: Immediately disable or restrict the code-quality.yml workflow to prevent execution on pull requests from forks; review recent pull requests and build artifacts for suspicious activity. Within 7 days: Implement mandatory code review and approval processes for all workflow modifications; audit GitHub Actions permissions and consider using GITHUB_TOKEN with read-only access for fork PRs. Within 30 days: Migrate to GitHub Actions environment protection rules or alternative CI/CD solutions with stronger fork isolation; establish a formal supply chain security review process for all development tooling.

iOS CVE-2026-31852

CRITICAL

Improper Privilege Management (CWE-269)

2026-03-11 security-advisories@github.com

Privilege Escalation RCE Apple iOS

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.