Taskcluster
Monthly
Unauthenticated remote code execution affects Taskcluster deployments running versions prior to 100.3.0 that expose the GraphQL endpoint to an anonymous role. The vulnerable code path is the GraphQL `filter: JSON` argument on list/search queries (clients, roles, secrets, worker pools, denylist addresses, artifacts, hooks, namespaces), which was parsed with the `sift` library using improper input validation (CWE-20); a crafted filter payload can lead to code execution on the web-server, giving full confidentiality, integrity, and availability impact (assessed CVSS 3.1 9.8, raw vendor CVSS 4.0 8.7). Exploitation is network-reachable and needs no authentication or user interaction, but is conditional on the deployment granting an anonymous role access to GraphQL; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the vendor-released patch is version 100.3.0.
Unauthenticated remote code execution affects Taskcluster deployments running versions prior to 100.3.0 that expose the GraphQL endpoint to an anonymous role. The vulnerable code path is the GraphQL `filter: JSON` argument on list/search queries (clients, roles, secrets, worker pools, denylist addresses, artifacts, hooks, namespaces), which was parsed with the `sift` library using improper input validation (CWE-20); a crafted filter payload can lead to code execution on the web-server, giving full confidentiality, integrity, and availability impact (assessed CVSS 3.1 9.8, raw vendor CVSS 4.0 8.7). Exploitation is network-reachable and needs no authentication or user interaction, but is conditional on the deployment granting an anonymous role access to GraphQL; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, and the vendor-released patch is version 100.3.0.