CVE-2026-76826: tsParticles: Generated release notes can execute shell commands in the stable publish workflow
tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAWRELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUBTOKEN and write permissions. This issue is fixed in version 4.3.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tsParticlesto a version that resolves this vulnerability.Fixed in 4.3.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected component is the stable publish workflow, not the library's runtime particle-animation functionality. Exposure is limited to maintainers or repositories that run the vulnerable stable release process with contributor-influenced generated release-note content.
What must an attacker do to exploit it?
An attacker needs to get shell metacharacters into generated release-note text that reaches steps.release.outputs.body. A maintainer must then start a stable release, causing that content to be interpolated into Bash and executed.
What could an attacker do after successful exploitation?
The injected commands can modify generated artifacts or workspace scripts. Those changes can affect later release steps that have GITHUB_TOKEN and write permissions.
Which versions are affected and how can the issue be remediated?
Versions from 4.0.0 until 4.3.2 are affected. Update to version 4.3.2, which fixes the issue.