Taskcluster CVE-2026-55094

Exploitation requires a Taskcluster deployment (prior to v100.3.0) configured with an anonymous role that exposes the GraphQL endpoint to unauthenticated callers, AND the vulnerable list/search queries that accept the filter: JSON argument parsed by the sift library. Given those conditions, no authentication or user interaction is needed (PR:N/UI:N) and the attack is network-reachable (AV:N). The primary limiting factor is the anonymous-role configuration: deployments that do not expose GraphQL to an anonymous role are not remotely exploitable by unauthenticated attackers. Affected versions: all Taskcluster releases before 100.3.0; the definitive mitigation is upgrading to 100.3.0 (which removes the sift dependency), or as an interim measure disabling/restricting the anonymous role's access to the GraphQL endpoint.

This is a genuinely high-priority flaw where the raw CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) likely UNDERSTATES the technical impact. The description explicitly states 'unauthenticated RCE', yet the vendor's CVSS 4.0 vector marks only VC:H (confidentiality) with VI:N/VA:N - a direct conflict: a remote code execution primitive should carry integrity and availability impact as well. The root cause is passing an attacker-controlled GraphQL 'filter: JSON' argument into the sift library, whose MongoDB-style query operators ($where and function-valued operators) allow arbitrary JavaScript evaluation in the Node.js web-server process - a well-known sift/NoSQL-operator injection-to-RCE pattern, corroborated by the patch which removed sift entirely and replaced filter with a typed searchTerm: String. No EPSS score, KEV listing, or public PoC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; this is not confirmed in-the-wild activity. The critical caveat is the exploitation gate: the vulnerable path is only reachable when a deployment configures an anonymous role that exposes the GraphQL endpoint - meaning that despite PR:N, real-world exposure depends on deployment configuration, not a default. Net: high technical severity on affected configurations, but blast radius is limited by Taskcluster's niche footprint and the anonymous-role prerequisite.

An attacker who can reach a Taskcluster deployment's GraphQL endpoint - one configured with an anonymous role granting query access - sends an unauthenticated query supplying a crafted filter: JSON object containing sift query operators such as $where with a function payload. When the server evaluates the filter via sift, the attacker's JavaScript executes in the web-server process, yielding remote code execution. No public PoC is referenced, but the fix (wholesale removal of sift) confirms the primitive.