Meshtastic 2.5.21/2.7.15 Workflow main_matrix.yml pull_request_target author_association command injection

Summaryinfo

A vulnerability described as critical has been identified in Meshtastic. This impacts the function pull_request_target of the file main_matrix.yml of the component Workflow. The manipulation of the argument author_association results in command injection. This vulnerability is reported as CVE-2026-44359. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Meshtastic. Affected is the function pull_request_target of the file main_matrix.yml of the component Workflow. The manipulation of the argument author_association with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-44359 since 05/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.7.21.1370b23 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-45873). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Meshtastic

Version

• 2.5.21
• 2.7.15

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion