Executive brief
MeltanoHub is the central repository for Meltano plugins. A security flaw in its automated testing workflows allowed unauthorized individuals to execute malicious commands by simply submitting a specially crafted pull request. This could have allowed an attacker to gain write access to the repository, potentially compromising the integrity of the plugin ecosystem.
Technical details
A command injection vulnerability existed in the `test_dispatcher.yml` GitHub Actions workflow of MeltanoHub. The `get_changed_files` job used the `pull_request_target` event and unsafely interpolated the `${{ steps.changed_files.outputs.all_changed_files }}` output directly into a shell command. Because `pull_request_target` runs in the context of the base repository and has access to secrets, an attacker could trigger the vulnerability by submitting a pull request containing a file with a name designed for bash command substitution (e.g., `$(command)`). This allowed for arbitrary code execution on the runner and exfiltration of the `GITHUB_TOKEN` which, due to a lack of a permissions block, defaulted to having write access. The issue was fixed by properly scoping token permissions and using environment variables instead of direct interpolation.
Affected products
- Meltano MeltanoHub prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173
Timeline
- 2026-04-30: patched: Initial fix PR submitted
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD
References
- https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173
- https://github.com/meltano/hub/pull/2247
- https://github.com/meltano/hub/pull/2249
- https://github.com/meltano/hub/pull/2251
- https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w
- https://github.com/myogahunter/meltano-hub-poc