OmniBlocks Monorepo Discussion Creation disc.yml behavioral workflow

Summaryinfo

A vulnerability identified as problematic has been detected in OmniBlocks Monorepo. This impacts an unknown function of the file .github/workflows/disc.yml of the component Discussion Creation. Performing a manipulation results in behavioral workflow. This vulnerability is identified as CVE-2026-54594. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in OmniBlocks Monorepo (affected version not known). It has been classified as problematic. This affects some unknown functionality of the file .github/workflows/disc.yml of the component Discussion Creation. The manipulation with an unknown input leads to a behavioral workflow vulnerability. CWE is classifying the issue as CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. This is going to have an impact on integrity, and availability. The summary by CVE is:

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54594 since 06/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch 627e0f0a16a7d74b09128106b57dd7e85d2545df is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OmniBlocks

Name

• Monorepo

Website

• Product: https://github.com/OmniBlocks/monorepo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion