GHSL-2026-190: TOCTOU in the MongoDB JS mongodb-connection-string-url release notes workflow
The releasenotes workflow checks out a mutable pull request ref after a maintainer authorizes a run. An external contributor can exploit this race condition to execute code with a write-scoped GITHUBTOKEN.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the TOCTOU race condition in the GHSL-2026-190 MongoDB JS `mongodb-connection-string-url` `release_notes` workflow by preventing checkout of a mutable pull request ref after maintainer authorization (use an immutable commit SHA instead of a PR ref).
Event History
Frequently Asked Questions
Which pull requests present an exploitation opportunity?
Pull requests from external contributors can be exploited when a maintainer authorizes the release_notes workflow to run against the contributor's mutable pull request ref.
What does an attacker need to do to exploit the issue?
The attacker needs to race the workflow by changing the pull request ref after the maintainer authorizes the run, causing the workflow to check out attacker-controlled code.
What access could attacker-controlled code receive?
The workflow can execute the code with a write-scoped GITHUB_TOKEN.