GHSL-2026-166: TOCTOU in the MongoDB Node.js Driver release notes workflow
Published Sep 16, 2026
·Updated
The releasenotes workflow checks out a mutable pull request ref after a maintainer authorizes a run. An external contributor can exploit this race condition to execute code with a write-scoped GITHUBTOKEN.
Affected Software
1 affected component
npm/mongodb
Event History
Sep 16, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An external contributor with a pull request is the relevant attacker. Exploitation depends on a maintainer authorizing the release_notes workflow run.
2
What must happen for the race condition to be exploited?
After a maintainer authorizes the workflow, the attacker must change the mutable pull request ref before it is checked out. The workflow then executes the attacker-controlled code with a write-scoped GITHUB_TOKEN.
3
What is the impact of a successful exploit?
A successful exploit allows code execution in the release_notes workflow with the permissions of its write-scoped GITHUB_TOKEN.