← CVE Intelligence

CVE-2026-42603

OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target PUBLISHED

Description (CNA)

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.

Affected (CNA)

Vendor / productVersions
OWASP-BLT / BLTaffected < 2.1.2

CWE

CWE-94, CWE-95

References

ADP enrichment

CISA-ADP

No English description supplied.