Critical Command Injection Vulnerability in Conflibot: CVE-2026-55158
A critical vulnerability (CVE-2026-55158) with a CVSS score of 9.1 has been discovered in Conflibot, a tool used to warn about potential conflicts in GitHub pull requests. The vulnerability allows for arbitrary command execution, secret exfiltration, and unauthorized pushes due to improper handling of user-controlled input in the pull request branch name. This affects Conflibot versions prior to 1.2.1. Immediate patching or upgrade to version 1.2.1 or 2.0.0 is strongly recommended.