GHSL-2026-203: Same-second TOCTOU vulnerability in jupyterlab/maintainer-tools update-snapshots-checkout - CVE-2026-84973
The jupyterlab/maintainer-tools update-snapshots-checkout action uses one-second timestamps to reject pull request updates after an authorized comment. An attacker can win a same-second race, causing a privileged workflow to check out and execute attacker-controlled code.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Repositories that use the jupyterlab/maintainer-tools/update-snapshots-checkout action in a privileged workflow that checks out and executes pull request code after an authorized comment are exposed.
What does an attacker need to exploit it?
An attacker needs to update a pull request in the same second as an authorized comment. Winning that race can cause the privileged workflow to use attacker-controlled code.
Are default configurations affected?
The available information does not identify any default configuration. Exposure depends on using this action in a privileged workflow that performs the affected checkout and execution behavior.