CVE-2026-42603CWE-94CWE-95

OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target

High · published May 11, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weaknesses
CWE-94 · Improper Control of Generation of Code ('Code Injection'); CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-05-11T16:11Z
EPSS history
Timeline
  • 11 MAY 16:11Z
    OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target
    cvelistv5