Vendor
The conflibot GitHub Action (versions < 1.2.1) is vulnerable to command injection via attacker-controlled pull request branch names, leading to secret exfiltration when executed via pull_request_target.