{"id":"CVE-2026-55158","aliases":["EUVD-2026-78769","GHSA-2qvg-qr73-mqxp"],"status":"published","title":"Conflibot: Command injection via crafted pull request branch names under pull_request_target","description":"Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00804,"percentile":0.57034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-08-17T13:35:07Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"GitHub Actions","package":"wktk/conflibot","fixed_in":["1.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"wktk/conflibot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"wktk/conflibot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}]}],"products":[{"vendor":"wktk","product":"conflibot"}],"references":[{"url":"https://github.com/wktk/conflibot/security/advisories/GHSA-2qvg-qr73-mqxp","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/wktk/conflibot/pull/329","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/wktk/conflibot/commit/0107ac6a4575ea200d0b92287ea58f975be9505d","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/wktk/conflibot/commit/59e255c49c920fd6b67471ab9ef3bf194439a3f2","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/wktk/conflibot/releases/tag/v1.2.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/wktk/conflibot/releases/tag/v2.0.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/wktk/conflibot/commit/0107ac6","tags":["web"]},{"url":"https://github.com/wktk/conflibot/commit/59e255c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2qvg-qr73-mqxp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55158.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55158","tags":["advisory"]},{"url":"https://github.com/wktk/conflibot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55158","title":"Conflibot: Command injection via crafted pull request branch names under pull_request_target","description":"Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.","status":"published","published":"2026-09-15T14:47:58.804Z","modified":"2026-09-17T14:42:35.993Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-78769","description":"Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.","status":"published","published":"2026-09-15T14:47:58Z","modified":"2026-09-17T14:42:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-2qvg-qr73-mqxp","title":"conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target","description":"### Impact\n\nVersions of conflibot before `1.2.1` build `git` commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (`head.ref`), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `` ` ``, `$( )`, `;`, `|`, or `\u0026`.\n\nThe recommended workflow runs conflibot on the `pull_request_target` event, where the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required — the action runs automatically when the pull request is opened.\n\n### Affected configurations\n\nAny workflow using `wktk/conflibot` at a version earlier than `1.2.1`. The risk is highest under `pull_request_target` (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.\n\n### Patches\n\nFixed in `1.2.1` and `2.0.0`. All `git` invocations now use argument arrays via `execFile`/`spawn` instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through `refs/pull/\u003cn\u003e/head` rather than by branch name.\n\n### Workarounds\n\nThere is no configuration-only workaround for affected versions. Upgrade to `wktk/conflibot@v2`. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later.\n\n### Resources\n\n- Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6\n- Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c\n- Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1","status":"published","published":"2026-08-17T13:35:07Z","modified":"2026-08-17T13:35:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-55158","description":"Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.","status":"published","published":"2026-09-15T15:17:18.593Z","modified":"2026-09-29T19:07:47.037Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-55158","title":"Conflibot: Command injection via crafted pull request branch names under pull_request_target","description":"Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.","status":"published","published":"2026-09-15T14:47:58.804Z","modified":"2026-10-28T02:30:33.602973364Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-2qvg-qr73-mqxp","title":"conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target","description":"### Impact\n\nVersions of conflibot before `1.2.1` build `git` commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (`head.ref`), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `` ` ``, `$( )`, `;`, `|`, or `\u0026`.\n\nThe recommended workflow runs conflibot on the `pull_request_target` event, where the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required — the action runs automatically when the pull request is opened.\n\n### Affected configurations\n\nAny workflow using `wktk/conflibot` at a version earlier than `1.2.1`. The risk is highest under `pull_request_target` (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.\n\n### Patches\n\nFixed in `1.2.1` and `2.0.0`. All `git` invocations now use argument arrays via `execFile`/`spawn` instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through `refs/pull/\u003cn\u003e/head` rather than by branch name.\n\n### Workarounds\n\nThere is no configuration-only workaround for affected versions. Upgrade to `wktk/conflibot@v2`. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later.\n\n### Resources\n\n- Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6\n- Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c\n- Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1","status":"published","published":"2026-08-17T13:35:07Z","modified":"2026-08-17T13:55:59.870885Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}