Which versions of MaaAssistantArknights are affected by CVE-2026-55576?

MaaAssistantArknights' GitHub Actions CI pipeline contains an expression injection vulnerability that allows external attackers to execute arbitrary shell commands during builds by opening pull…

How to fix or mitigate CVE-2026-55576?

Within 24 hours: if your organization uses MaaAssistantArknights, immediately review recent CI runs and pull requests with titles starting with 'Release v' for unauthorized command execution; if you maintain the project, disable the `pull_request` and `pull_request_target` events on the affected workflow or restrict them to non-fork repositories. Within 7 days: implement compensating controls by refactoring the workflow to eliminate direct inlining of user-controlled data into shell commands using GitHub Actions environment variables or official context objects instead; add required approval steps for release preparation jobs. Within 30 days: monitor the MaaAssistantArknights project for an official patch release; upon availability, test and apply the patch to your CI configuration.

MaaAssistantArknights CVE-2026-55576

Q: What is the CVSS score of CVE-2026-55576?

CVE-2026-55576 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

OS Command Injection (CWE-78)

2026-07-15 GitHub_M

Ubuntu Command Injection Maaassistantarknights

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Remotely reachable via a crafted fork-PR title (AV:N/AC:L/PR:N), but GitHub's first-contributor workflow-approval gate warrants UI:R; runner integrity is high while the read-only fork token limits confidentiality and availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 22:01 vuln.today

Analysis Generated

Jul 15, 2026 - 22:01 vuln.today

CVE Published

Jul 15, 2026 - 21:02 cve.org

HIGH 8.8

DescriptionCVE.org

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull_request.title into a run: shell command during the pull_request opened, reopened, and ready_for_review events, so a non-draft fork PR whose title starts with Release v could execute shell commands on the ubuntu-latest runner during the generate-changelog job. This vulnerability is fixed by commit cafc3946059e6337d2089d4fec8b6885ba17c332.

AnalysisAI

GitHub Actions expression injection in MaaAssistantArknights' dev-v2 CI (release-preparation.yml) lets an external attacker execute arbitrary shell commands on the ubuntu-latest runner by opening a non-draft fork pull request whose title begins with 'Release v'. The attacker-controlled pull_request.title was inlined directly into a run: block during opened, reopened, and ready_for_review events, so a crafted title breaks out of the sed command in the generate-changelog job. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the class is trivially weaponizable and the fix commit (cafc3946) is public. EPSS was not provided.

Technical ContextAI

The root cause is CWE-78 (OS Command Injection) realized through the GitHub Actions template-expansion mechanism. GitHub evaluates ${{ ... }} expressions and substitutes their literal text into the shell script of a run: step BEFORE the shell executes, so any expression carrying untrusted data (here github.event.pull_request.title) is concatenated into the command line rather than passed as data. In the vulnerable release-preparation.yml the title fed a tag_name=$(echo "${{ github.event.pull_request.title }}" | sed ...) pipeline, so shell metacharacters such as backticks or $(...) in the title are interpreted by bash on the runner. The single affected product per CPE is cpe:2.3:a:maaassistantarknights:maaassistantarknights, an open-source one-click automation tool for the game Arknights, and the exposure is confined to its own CI/CD pipeline on GitHub-hosted Ubuntu runners rather than to any installed copy of the desktop tool.

RemediationAI

Upstream fix available (commit cafc3946059e6337d2089d4fec8b6885ba17c332); no packaged release version applies since the change is to CI workflow files, so downstream users of the tool need take no action and repository maintainers should ensure dev-v2/default branches have merged this commit. The fix applies two independent controls: it moves untrusted values (PR_TITLE, PR_URL, TAG_NAME, LATEST, etc.) into env: variables referenced as quoted shell variables ("$PR_TITLE") instead of inlining ${{ }} into run:, and it adds a fork guard if: github.event.pull_request.head.repo.full_name == github.repository so the automation short-circuits for fork PRs whose tokens are read-only anyway. If immediate merging is not possible, compensating controls are: disable or gate the release-preparation.yml triggers on pull_request opened/reopened/ready_for_review (trade-off: breaks automatic changelog generation), require approval for all outside-contributor workflow runs in repository Actions settings (trade-off: adds maintainer toil), or manually apply the env-var pattern to any remaining run: step that references github.event data. See GHSA-pqx2-5g66-f5w8 for the advisory.