EUVD-2026-36290Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR-author can trigger it over the network with no auth or UI, but must craft a run that satisfies the main-branch gate (AC:H); deploy job's privileges compromise the production site (S:C, C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker can make a pull request build satisfy the deploy workflow’s main branch condition, the deploy job checks out the triggering workflow commit, builds it into a Docker image, pushes it as latest, and triggers Dokploy deployment. This can allow attacker-controlled pull request code to become the deployed production site image without being merged. This issue has been patched in version 1.0.1.
Articles & Coverage 1
AnalysisAI
Production deployment compromise in Duck Site before 1.0.1 allows remote attackers to push attacker-controlled code as the live production Docker image without code review or merge approval. The flaw stems from a GitHub Actions deploy workflow that can be tricked into treating an unmerged pull request build as a main-branch deployment, then checking out the PR commit, building it, pushing it as the latest Docker tag, and triggering a Dokploy deployment. No public exploit identified at time of analysis, and CVE is not listed in CISA KEV.
Technical ContextAI
Duck Site is a containerized site application built and shipped through a two-stage GitHub Actions pipeline: a build workflow that runs on pull_request events and a deploy workflow that runs on workflow_run completion with elevated permissions (packages: write) and access to deployment secrets. The deploy workflow is gated by a 'main branch' condition that is supposed to limit it to post-merge runs, but the condition can be satisfied by a pull-request-originated workflow run. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) applies here because the privileged deploy job ends up sourcing build artifacts and code (actions/checkout of the triggering workflow's commit) from an untrusted PR context while operating with trusted-context privileges, a well-known pwn_request / workflow_run anti-pattern in GitHub Actions. Affected CPE is cpe:2.3:a:duck-organization:duck-site, and the fix is delivered via GHSA-qj93-7xrg-rvhw.
RemediationAI
Vendor-released patch: upgrade to Duck Site 1.0.1, which corrects the deploy workflow's gating so that pull-request-originated workflow_run events can no longer satisfy the main-branch deployment condition; the fix is described in the GitHub Security Advisory at https://github.com/duck-organization/duck-site/security/advisories/GHSA-qj93-7xrg-rvhw. For operators who cannot immediately upgrade, the highest-leverage workarounds are to require GitHub Actions approval for pull requests from first-time/external contributors (Settings → Actions → 'Require approval for all outside collaborators'), remove the workflow_run trigger from the deploy workflow and instead trigger deploys only on push to main (trade-off: loses any intentional cross-workflow chaining), or scope the deploy job with an explicit if: github.event.workflow_run.head_branch 'main' && github.event.workflow_run.event 'push' check so PR-originated runs are filtered out (trade-off: requires careful auditing of every branch protection rule). As a defense-in-depth measure, rotate any GHCR tokens and Dokploy deployment secrets that may have been exposed to a malicious PR run while the workflow was vulnerable.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today