Executive brief
OWASP BLT, a platform for QA testing and vulnerability disclosure, contains a security flaw in its automated development workflows. An attacker can submit a malicious pull request that, when reviewed by a maintainer, executes unauthorized code within the project's build environment. This could allow an attacker to steal sensitive credentials (secrets), modify the source code repository, or launch supply chain attacks against users of the platform.
Technical details
A Remote Code Execution (RCE) vulnerability exists in the `.github/workflows/regenerate-migrations.yml` workflow due to an unsafe combination of a privileged trigger and untrusted input. The workflow uses `pull_request_target`, which grants the runner a `GITHUB_TOKEN` with write permissions even for forks. It specifically uses `git show` to copy an attacker-controlled `models.py` file into the trusted workspace and then runs `python manage.py makemigrations`. Because Django imports model modules during this process, any module-level Python code in the attacker's file is executed. This allows an unauthenticated external contributor to exfiltrate repository secrets or compromise the repository if a maintainer applies the 'regenerate-migrations' label to their pull request. The issue is addressed in version 2.1.1.
Affected products
- OWASP BLT < 2.1.1
Timeline
- 2026-04-09: advisory: GitHub Security Advisory GHSA-wxm3-64fx-cmx9 published
- 2026-04-15: disclosed: CVE-2026-40316 published