CVE-2026-42603: OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pullrequesttarget (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42603?
CVE-2026-42603 is considered a high severity vulnerability due to the execution of untrusted code in a privileged context.
How do I fix CVE-2026-42603?
To mitigate CVE-2026-42603, upgrade OWASP BLT to version 2.1.2 or later.
What type of vulnerability is CVE-2026-42603?
CVE-2026-42603 is a security vulnerability that allows untrusted code execution through the usage of pull_request_target.
Which versions of OWASP BLT are affected by CVE-2026-42603?
CVE-2026-42603 affects all versions of OWASP BLT prior to 2.1.2.
How does CVE-2026-42603 impact security?
CVE-2026-42603 can potentially allow attackers to execute malicious code in the context of the repository, compromising its security.