CVE-2026-27941

Katalog CVE

CVSS 9.9 · Critical EPSS 0,57%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada openlit software development kit. Skor CVSS 3.1 9.9 (Critical) menurut github.com.

Deskripsi (NVD)

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q exploit · mitigasi · advisory vendor
• https://github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546c patch