https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:58:57.106529+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-53546 CVE-2025-53546 — Folo allows secrets exfiltration via `pull_request_target` 2026-10-08T16:58:57.121065+00:00

Affected: RSSNext Folo

Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.