live-codes livecodes Title code injection

Summaryinfo

A vulnerability identified as critical has been detected in live-codes livecodes. The impacted element is an unknown function of the component Title Handler. The manipulation leads to code injection. This vulnerability is listed as CVE-2026-27701. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in live-codes livecodes (affected version not known) and classified as critical. This issue affects some unknown functionality of the component Title Handler. The manipulation with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions workflow is vulnerable to JavaScript injection. The title of the Pull Request associated with the triggering issue comment is interpolated directly into a `actions/github-script` JavaScript block using a GitHub Actions template expression. An attacker who opens a PR with a crafted title can inject arbitrary JavaScript that executes with the privileges of the CI bot token (`CI_APP_ID` / `CI_APP_PRIVATE_KEY`), enabling exfiltration of repository secrets and unauthorized GitHub API operations. Commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 fixes the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-27701 since 02/23/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Applying the patch e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• live-codes

Name

• livecodes

Website

• Product: https://github.com/live-codes/livecodes/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion