Skip to content
OpenAdvisories

Vendor

OWASP-BLT

2 known vulnerabilities.

Products

BLT 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-42603

    OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target

    OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code d…

    OWASP-BLT BLT
  • High 8.8
    CVE-2026-40316

    OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow

    OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses th…

    OWASP-BLT BLT