GHSL-2026-229: External pull requests can execute commands in privileged release workflows - CVE-2026-92261
Published Oct 22, 2026
·Updated
The unified-github-workflows release check allows pull request-controlled version data to inject commands into a privileged workflow.
Affected Software
1 affected component
unified-github-workflows
Event History
Oct 22, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs to be able to submit an external pull request and control the version data consumed by the release check.
2
Which environments are exposed?
Repositories using unified-github-workflows where the release check runs in a privileged workflow and processes pull request-controlled version data are exposed.