CVE-2026-42603 OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target
Attackers can execute arbitrary code with write permissions by exploiting privileged GitHub Actions workflows that process untrusted fork code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-42603?
CVE-2026-42603 is a high-severity code injection vulnerability in OWASP-BLT BLT, published on 11 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.
Which versions are affected by CVE-2026-42603?
How do I fix CVE-2026-42603?
No fix has been published for CVE-2026-42603 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-42603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42603 exists.