Is CVE-2026-42603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42603 being exploited in the wild.

How severe is CVE-2026-42603?

High severity, with a CVSS score of 8.8, published 11 May 2026.

Is there a fix for CVE-2026-42603?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42603 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42603?

Check whether you run OWASP BLT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42603: OWASP BLT RCE via pull_request_target in GitHub Actions

CVE-2026-42603 · Severity: high · CVSS 8.8 · Published 2026-05-11

OWASP BLT is a platform used for quality assurance testing and vulnerability disclosure. A security flaw in its automated development workflows allows an attacker to execute malicious code within the project's build environment. If successful, an attacker could gain write access to the software repository, steal sensitive credentials, or compromise the integrity of the software being distributed to users.

Vendors: OWASP.

Quick answers

Is CVE-2026-42603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42603 being exploited in the wild.
How severe is CVE-2026-42603?: High severity, with a CVSS score of 8.8, published 11 May 2026.
Which products and versions are affected?: OWASP BLT < 2.1.2.
Is there a fix for CVE-2026-42603?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42603 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42603?: Check whether you run OWASP BLT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Poisoned Pipeline Execution (PPE) vulnerability exists in the `.github/workflows/pre-commit-fix.yaml` workflow. The workflow uses the `pull_request_target` trigger, which runs with elevated privileges, but it checks out the code from the attacker's head branch instead of the base repository. By modifying `.pre-commit-config.yaml` in a fork and triggering the workflow (which requires a maintainer to apply a specific label), an attacker can execute arbitrary code via malicious pre-commit hooks. This execution occurs with a `GITHUB_TOKEN` that has write permissions for contents, actions, and pull requests, potentially leading to repository takeover or secret exfiltration. The issue is fixed in version 2.1.2 by ensuring the workflow only checks out code from the base repository.

Affected products

OWASP BLT < 2.1.2

Timeline

2026-04-24: advisory: GitHub Security Advisory published by maintainers
2026-05-11: disclosed: CVE published to NVD dataset

References

https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-cgvj-qg2h-cqfh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.