Tag
#CVE-2026-55158
Critical Command Injection Vulnerability in Conflibot: CVE-2026-55158
A critical vulnerability (CVE-2026-55158) with a CVSS score of 9.1 has been discovered in Conflibot, a tool used to warn about potential conflicts in GitHub pull requests. The vulnerability allows for arbitrary command execution, secret exfiltration, and unauthorized pushes due to improper handling of user-controlled input in the pull request branch name. This affects Conflibot versions prior to 1.2.1. Immediate patching or upgrade to version 1.2.1 or 2.0.0 is strongly recommended.
Understanding and Defending Against Command Injection in conflibot via Crafted Pull Request Branch Names
This educational analysis covers a critical vulnerability in conflibot, a GitHub action, that allows for command injection via crafted pull request branch names. The vulnerability, tracked as CVE-2026-55158, affects versions before 1.2.1 and has a CVSS score of 9.1. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection strategies, and defensive measures.