Executive brief
OWASP BLT is a platform used for quality assurance testing and vulnerability disclosure. A security flaw in its automated development workflows allows an attacker to execute malicious code within the project's build environment. If successful, an attacker could gain write access to the software repository, steal sensitive credentials, or compromise the integrity of the software being distributed to users.
Technical details
A Poisoned Pipeline Execution (PPE) vulnerability exists in the `.github/workflows/pre-commit-fix.yaml` workflow. The workflow uses the `pull_request_target` trigger, which runs with elevated privileges, but it checks out the code from the attacker's head branch instead of the base repository. By modifying `.pre-commit-config.yaml` in a fork and triggering the workflow (which requires a maintainer to apply a specific label), an attacker can execute arbitrary code via malicious pre-commit hooks. This execution occurs with a `GITHUB_TOKEN` that has write permissions for contents, actions, and pull requests, potentially leading to repository takeover or secret exfiltration. The issue is fixed in version 2.1.2 by ensuring the workflow only checks out code from the base repository.
Affected products
- OWASP BLT < 2.1.2
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published by maintainers
- 2026-05-11: disclosed: CVE published to NVD dataset