CVE-2026-27941CWE-829

OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

Critical · published February 26, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00583 · 47.1th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-02-26T01:17Z
EPSS history
Timeline
  • 26 FEB 01:17Z
    OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows
    cvelistv5