{"id":"CVE-2026-76826","aliases":["EUVD-2026-117158","GHSA-gw8q-3x59-mjjx"],"status":"published","title":"tsParticles: Generated release notes can execute shell commands in the stable publish workflow","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","severity":{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00305,"percentile":0.23526,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-11-04T22:11:45Z","modified":"2026-11-05T20:23:54Z","products":[{"vendor":"tsparticles","product":"tsparticles"}],"references":[{"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/tsparticles/tsparticles/pull/5888","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76826.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76826","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-76826","title":"tsParticles: Generated release notes can execute shell commands in the stable publish workflow","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","status":"published","published":"2026-11-04T22:11:45.939Z","modified":"2026-11-05T20:23:54.644Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-05T21:25:06.152449Z"}],"euvd":[{"id":"EUVD-2026-117158","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","status":"published","published":"2026-11-04T22:11:45Z","modified":"2026-11-05T20:23:54Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T21:01:57.572849Z"}],"nvd":[{"id":"CVE-2026-76826","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","status":"published","published":"2026-11-04T23:17:58.4Z","modified":"2026-11-06T21:32:18.733Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-07T00:02:36.119898Z"}],"osv":[{"id":"CVE-2026-76826","title":"tsParticles: Generated release notes can execute shell commands in the stable publish workflow","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","status":"published","published":"2026-11-04T22:11:45.939Z","modified":"2026-11-08T02:31:08.175313736Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-07T03:08:10.477794Z"}]}}