Skip to content
OpenAdvisories

Package · GitHub Actions

wktk/conflibot

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.1
    CVE-2026-55158

    Conflibot: Command injection via crafted pull request branch names under pull_request_target

    Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref …

    wktk conflibot wktk/conflibot GitHub Actions