CVE-2026-55158 in conflibot
Summary
by MITRE • 09/15/2026
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as CVE-2024-38795 represents a critical command injection flaw within the Conflibot GitHub Action, specifically affecting versions prior to 1.2.1 for v1 and prior to 2.0.0 for v2. This security issue stems from improper neutralization of special elements used in shell commands, allowing an attacker to inject arbitrary operating system commands through maliciously crafted input data. The core technical flaw resides in the src/index.ts file, where git operations such as checkout, merge, and format-patch are constructed by directly interpolating user-controlled values into command strings passed to the exec function. Specifically, the pull request head.ref value is interpolated without sanitization or escaping, creating a direct pathway for shell metacharacters present in branch names to be interpreted as executable commands by the underlying operating system shell.
The operational impact of this vulnerability is severe due to the execution context within GitHub Actions workflows configured with the pull_request_target event type. This configuration grants the workflow access to secrets and permissions associated with the base repository, rather than those restricted by the forked source repository. An attacker can exploit this by opening a pull request from a fork where the branch name contains shell metacharacters such as semicolons, pipes, or backticks. When the Conflibot action triggers automatically to check for merge conflicts, it processes these malicious branch names without requiring any manual interaction from repository maintainers. Consequently, arbitrary commands are executed on the GitHub-hosted runner with elevated privileges, including write-scoped GITHUB_TOKEN access and exposure to base-repository secrets.
The consequences of successful exploitation include full remote code execution within the CI/CD pipeline environment. Attackers can exfiltrate sensitive credentials stored as repository or organization secrets, steal the GITHUB_TOKEN for further unauthorized API calls, push malicious changes directly to the protected main branch, or perform other forms of token abuse that compromise the integrity and confidentiality of the software supply chain. This aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) and maps to MITRE ATT&CK techniques including T1059 Command and Scripting Interpreter for execution, T1048 Exfiltration Over Alternative Protocol if data is exfiltrated via network channels, and potentially T1623 Impersonation if the attacker leverages stolen tokens.
Mitigation strategies require immediate upgrading to fixed versions of the Conflibot action, specifically version 1.2.1 or later for v1 workflows and version 2.0.0 or later for v2 workflows. The remediation implemented in these updates involves refactoring the codebase to use execFile or spawn functions with argument arrays instead of shell execution via exec. This approach ensures that arguments are passed as distinct parameters rather than being concatenated into a single command string, thereby preventing shell interpretation of special characters. Additionally, for v2 implementations, the fix includes using numeric pull request references rather than branch names, which further reduces the attack surface by eliminating reliance on user-controlled text inputs for critical git operations. Organizations should also audit their GitHub Actions workflows to ensure that third-party actions are kept up-to-date and consider implementing strict input validation or allowlisting of acceptable characters in branch naming conventions as a defense-in-depth measure against similar injection attacks.