Skip to content
Threat Feed
Subscribe

Product

Conflibot

1 brief RSS
critical advisory

Command Injection in conflibot via Crafted Git Branch Names

The conflibot GitHub Action (versions < 1.2.1) is vulnerable to command injection via attacker-controlled pull request branch names, leading to secret exfiltration when executed via pull_request_target.

conflibot
2t