OpenLIT up to 1.37.0 Google Cloud Service pull_request_target inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability classified as critical has been found in OpenLIT up to 1.37.0. Affected by this vulnerability is the function pull_request_target of the component Google Cloud Service. This manipulation causes inclusion of functionality from untrusted control sphere. This vulnerability is handled as CVE-2026-27941. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in OpenLIT up to 1.37.0. Affected by this vulnerability is the function pull_request_target of the component Google Cloud Service. The manipulation with an unknown input leads to a inclusion of functionality from untrusted control sphere vulnerability. The CWE definition for the vulnerability is CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-27941 since 02/25/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 1.37.1 eliminates this vulnerability. Applying the patch 4a62039a1659d6cbb8913172693f587b5fc2546c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• OpenLIT

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37.0

License

• open-source

Website

• Product: https://github.com/openlit/openlit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion