Description (CNA)
Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pull_request_target trigger combined with checkout of untrusted PR code. An attacker can exploit this to steal credentials, post comments, push code, or create releases.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| eigent-ai / eigent | affected < bf02500bbbab0f01cd0ed8e6dc21fe5683d6bfb5 |
CWE
CWE-94
References
- https://github.com/eigent-ai/eigent/security/advisories/GHSA-gvh4-93cq-5xxp
- https://github.com/eigent-ai/eigent/pull/836
- https://github.com/eigent-ai/eigent/pull/837
- https://github.com/eigent-ai/eigent/commit/bf02500bbbab0f01cd0ed8e6dc21fe5683d6bfb5
ADP enrichment
No English description supplied.
No references supplied.