Is there a patch available for CVE-2026-58502?

Yes, a patch is available for CVE-2026-58502. Update the affected software to the latest version immediately.

Githubtoplanguages CVE-2026-58502

Q: What is the CVSS score of CVE-2026-58502?

CVE-2026-58502 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-78911 HIGH

OS Command Injection (CWE-78)

2026-09-15 GitHub_M

Command Injection Githubtoplanguages

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 15, 2026 - 19:20 vuln.today

Patch available

Sep 15, 2026 - 18:18 EUVD

Source Code Evidence Fetched

Sep 15, 2026 - 18:07 vuln.today

Analysis Generated

Sep 15, 2026 - 18:07 vuln.today

CVE Published

Sep 15, 2026 - 17:37 cve.org

HIGH 7.1

DescriptionCVE.org

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.

AnalysisAI

Command injection in the GitHub Actions workflow shipped with githubtoplanguages (versions before 1.1.4) lets anyone who can open an issue on a repository running the bundled discord-issue.yml workflow execute arbitrary shell commands on the Actions runner. The issue title is expanded by GitHub Actions directly into a Bash assignment, so a title containing $(...) command-substitution syntax is evaluated by the shell before the value is posted to Discord; a public proof-of-concept was demonstrated by the reporter in a fork. …