CVE-2026-92261: GHSL-2026-229: External pull requests can execute commands in privileged release workflows - CVE-2026-92261

Published Oct 22, 2026

Updated

The unified-github-workflows release check allows pull request-controlled version data to inject commands into a privileged workflow.

Affected Software

1 affected component

Unifiedjs unified-github-workflows

Oct 22, 2026

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

Description

The attacker would need to control version data in an external pull request that is processed by the privileged release workflow.

The issue affects the release check in unified-github-workflows when it handles pull request-controlled version data in a privileged workflow.