# CVE-2026-55158: conflibot command injection in pull request branch names

Source: https://junglewise.ai/threats/cve-2026-55158-conflibot-command-injection-in-pull-request-branch-names  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-55158 · Severity: critical · CVSS 9.1 · Published 2026-09-15

conflibot is a GitHub Actions workflow tool that automatically detects merge conflicts in pull requests. Versions before 1.2.1 construct git commands by concatenating user-controlled pull request branch names into shell commands without sanitization. An attacker can open a pull request with a malicious branch name containing shell metacharacters to execute arbitrary commands on the runner, potentially exfiltrating repository secrets and write-scoped tokens or pushing malicious code to the repository.

Vendors: [GitHub Actions](https://junglewise.ai/threats/vendors/actions).

## Quick answers

**Is CVE-2026-55158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55158 being exploited in the wild.

**How severe is CVE-2026-55158?** Critical severity, with a CVSS score of 9.1, published 15 September 2026.

**Which products and versions are affected?** wktk/conflibot (GitHub Actions) < 1.2.1; Wktk Conflibot < 1.2.1.

**Is there a fix for CVE-2026-55158?** A patch was published on 2026-06-11: Fixed in v1.2.1 and v2.0.0; commits 59e255c and 0107ac6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55158 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55158?** Check whether you run wktk/conflibot (GitHub Actions) or Wktk Conflibot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

conflibot is vulnerable to OS command injection (CWE-78) in git command construction. The action builds git commands via string interpolation of pull request branch names (head.ref) and executes them through a shell, allowing shell metacharacters (backticks, $(), ;, |, &) in branch names to be interpreted as command syntax. Under the recommended pull_request_target event workflow, the job runs with write-scoped GITHUB_TOKEN and repository secrets in the environment, making the attack highly impactful. Exploitation requires only opening a pull request with a crafted branch name—no special privileges or user interaction is needed. The fix (v1.2.1 and v2.0.0) eliminates the shell by using execFile/spawn with argument arrays, ensuring branch names are treated as literal data. v2.0.0 additionally references pull requests by number through refs/pull/&lt;n&gt;/head instead of branch names.

## Affected products

- wktk conflibot < 1.2.1

## Identifiers

- CVE-2026-55158
- GHSA-2qvg-qr73-mqxp

## Timeline

- 2026-06-10: disclosed: Published to GitHub Advisory Database as GHSA-2qvg-qr73-mqxp
- 2026-06-11: patched: Fixed in v1.2.1 and v2.0.0; commits 59e255c and 0107ac6

## References

- [https://github.com/wktk/conflibot/security/advisories/GHSA-2qvg-qr73-mqxp](https://github.com/wktk/conflibot/security/advisories/GHSA-2qvg-qr73-mqxp)
- [https://github.com/wktk/conflibot/commit/0107ac6](https://github.com/wktk/conflibot/commit/0107ac6)
- [https://github.com/wktk/conflibot/commit/59e255c](https://github.com/wktk/conflibot/commit/59e255c)
- [https://github.com/wktk/conflibot/releases/tag/v1.2.1](https://github.com/wktk/conflibot/releases/tag/v1.2.1)
- [https://github.com/wktk/conflibot/releases/tag/v2.0.0](https://github.com/wktk/conflibot/releases/tag/v2.0.0)
- [https://api.github.com/repos/wktk/conflibot/security-advisories/GHSA-2qvg-qr73-mqxp](https://api.github.com/repos/wktk/conflibot/security-advisories/GHSA-2qvg-qr73-mqxp)