GHSL-2026-167: TOCTOU in the MongoDB JS BSON release notes workflow
Published Sep 16, 2026
·Updated
The releasenotes workflow checks out a mutable pull request ref after a maintainer authorizes a run. An external contributor can exploit this race condition to execute code with a write-scoped GITHUBTOKEN.
Event History
Sep 16, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
Who can exploit this workflow?
An external contributor with a pull request is the relevant attacker. They can change the mutable pull request ref after a maintainer authorizes the workflow run.
2
What level of access could successful exploitation provide?
The attacker could execute code using a write-scoped GITHUB_TOKEN, giving the workflow code write-level repository token permissions.
3
Does exploitation require maintainer interaction?
Yes. The workflow must first be authorized by a maintainer before the contributor can exploit the race by changing the pull request ref.