CVE-2026-42298

Katalog CVE

CVSS 9.8 · Critical EPSS 0,81%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada gitroom postiz. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-v975-9h5p-xhm4 advisory vendor
• https://github.com/gitroomhq/postiz-app/commit/da448012dd87e94944cbe83a38e7fd023269ec46 url repurposed