Classroom 50 CVE-2026-94620

Exploitation requires: (1) the attacker to be an enrolled student with a writable assignment repository in the classroom GitHub organization; (2) the student to commit result.json or results.json as a symlink, hardlink, or special file (git materializes it verbatim on clone); and (3) the teacher to run the vulnerable gh teacher download (version prior to 1.11.0) against that untrusted repository - this is the UI:P requirement and the primary limiting factor. The write bytes are attacker-controlled via the student's uploaded release asset (result.json) or chosen submit-tag names (results.json). Limiting factors: the attack is not anonymous (requires classroom enrollment), is not zero-click (requires the teacher to execute the download), and is fully mitigated by upgrading to 1.11.0 or by the documented workarounds (run in a disposable sandbox/container without host credential access, or inspect cloned trees for symlinked/hardlinked/special result.json/results.json entries before the artifact-refresh step).

This is a genuine high-priority vulnerability, not a CVSS-inflated one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H = 9.4 Critical) is well-supported by the description and the patch diff: a symlink/hardlink planted at result.json or results.json redirects an attacker-controlled write out of the clone into host files the teacher owns (~/.ssh/authorized_keys, ~/.zshrc, cron, or an in-clone .git/hooks/* that git then executes), yielding code execution as the teacher. The impact is amplified because the teacher's gh token carries admin:org, repo, and workflow across the whole classroom organization, so a single teacher victim equals full org compromise - this justifies the scope-change (SC/SI/SA:H). Tempering the raw score: exploitation is NOT zero-click. It requires UI:P (the teacher must run gh teacher download against the attacker's repo) and an attacker who is an enrolled student with a writable repo in the org - a trust-boundary that exists in every classroom by design, so PR:N is defensible even though the actor is not anonymous. No EPSS score, KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation; this is a pre-exploitation patch-and-advisory situation. Note, however, that the published commit ships a detailed regression test (TestRefreshResultJSON_SymlinkGuard) that enumerates the exact escaping-symlink, in-clone-symlink-to-.git/hooks, hardlink, and FIFO vectors, effectively documenting a working exploit recipe and lowering the barrier to weaponization.

A student enrolled in the classroom commits result.json (or results.json) into their assignment repository not as a file but as a symlink pointing to .git/hooks/post-checkout (or an escaping path like ../victim or ~/.ssh/authorized_keys). When the teacher runs gh teacher download, the tool clones the repo, materializes the symlink verbatim, then writes attacker-controlled bytes (the student's uploaded release asset or chosen submit-tag content) through it, dropping a malicious git hook that git executes - running code as the teacher with an admin:org/repo/workflow token over the entire organization. No public exploit was provided, though the patch's test suite documents the precise vectors.