← Back to the live CVE advisory feed

CVE-2026-55158: Product identification pending

Severity

9.1 (CRITICAL)

Affected versions

Before 1.2.1

Fixed version

1.2.1

Patch status

Patched

Published

2026-09-15T15:17:18.593

Modified

2026-09-15T15:17:18.593

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.

View the official NVD record for CVE-2026-55158

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.