Skip to content
OpenAdvisories

Vendor

cookpete

1 known vulnerabilities.

Products

auto-changelog 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.8
    CVE-2026-12171

    auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

    auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup op…

    cookpete auto-changelog