CVE-2026-94620 in Classroom 50
Summary
by MITRE • 10/01/2026
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
Classroom 50 is an open-source tool designed to facilitate the management and grading of programming assignments through GitHub integration. A critical security vulnerability was identified in versions prior to 1.11.0, specifically within the gh teacher download command functionality. This flaw represents a severe arbitrary file write condition that can lead to remote code execution on the instructor's machine or server environment where the tool is executed. The vulnerability stems from how the application handles symbolic links during the repository cloning and artifact writing processes, allowing an attacker who controls student submissions to manipulate the host system significantly.
The technical root cause lies in the sequence of operations performed by the gh teacher download command. When processing a student's assignment, the tool clones the student's GitHub repository into a local working tree. Following this clone operation, it attempts to write autograde artifacts, specifically result.json and results.json files, back into that same cloned directory. The implementation failed to account for symbolic links within the cloned file system structure. When git materializes these symlinks during the clone process, they retain their target paths relative to the working tree or absolute if configured as such. If a malicious student commits result.json or results.json as a symlink pointing outside the intended repository directory, the subsequent write operation by Classroom 50 follows this link without validation.
This behavior enables an attacker to redirect file writes to arbitrary locations on the host system where the teacher is running the tool. By crafting symlinks that point to sensitive files such as ~/.zshrc, ~/.ssh/authorized_keys, cron job configurations, or git hooks within .git/hooks/, a student can overwrite these critical files with content they control. Since the bytes written are derived from attacker-controlled inputs—such as uploaded release assets for result.json or chosen submit-tag names for results.json—the impact is not limited to data corruption but extends directly to code execution. For instance, overwriting ~/.ssh/authorized_keys allows persistent unauthorized access, while modifying git hooks can trigger arbitrary commands every time a git operation occurs in that repository context.
The operational impact of this vulnerability is compounded by the privileges associated with the gh tool's authentication token. In typical classroom setups, the teacher's GitHub Personal Access Token possesses broad permissions, including admin:org, repo, and workflow scopes across the entire organization. If an attacker achieves code execution on the host machine running Classroom 50, they effectively gain control over these high-privilege credentials. This could lead to further compromise of other repositories, unauthorized deployment of malicious workflows, or lateral movement within the organizational infrastructure. The vulnerability is classified under CWE-22 for Improper Limitation of a Pathname to a Restricted Directory and CWE-94 for Code Injection, reflecting both the path traversal aspect and the potential for executing arbitrary code through injected payloads in configuration files.
From an ATT&CK perspective, this vulnerability aligns with techniques involving T1053 Scheduled Task/Job as well as T1546 Event Triggered Execution via Git Hooks. The ability to write to authorized_keys also relates to persistence mechanisms found in lateral movement and credential access tactics. The severity is rated critically due to the ease of exploitation, which requires only a standard student submission containing specific symlink artifacts, and the high privilege level of the affected user context.
Version 1.11.0 of Classroom 50 includes a patch that mitigates this issue by ensuring that write operations do not follow symlinks or are validated against safe directories before execution. However, organizations relying on earlier versions must implement immediate workarounds to protect their environments. The primary recommendation is to avoid running the gh teacher download command against untrusted student repositories unless absolutely necessary and only in controlled conditions. A more robust mitigation involves executing the grading process within a disposable sandbox or containerized environment that has no access to sensitive host files, credentials, or network resources outside of its isolated scope. This isolation ensures that even if an arbitrary file write occurs, it remains contained within the ephemeral instance and does not impact the host system.
Additionally, administrators should inspect cloned repository trees for symbolic links, hardlinks, or special entries named result.json or results.json before allowing any artifact-refresh steps to run manually. Implementing pre-processing scripts that detect and neutralize such symlinks can provide an additional layer of defense. Regular audits of student submissions for malicious file structures are also advised until all instances of the software are upgraded to version 1.11.0 or later, where the underlying code handles these edge cases securely by default.