Is CVE-2026-76826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76826 being exploited in the wild.

How severe is CVE-2026-76826?

Informational severity, published 4 November 2026.

Is there a fix for CVE-2026-76826?

Yes: fixed in 4.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76826 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-76826?

Check whether you run tsParticles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76826: tsParticles shell injection in stable publish workflow

CVE-2026-76826 · Severity: info · Published 2026-11-04

tsParticles is a TypeScript library for creating particle animations. The stable release workflow unsafely interpolates contributor-controlled release notes into a Bash command, allowing malicious shell metacharacters to execute arbitrary code when a maintainer publishes a release. An attacker with commit access could modify release artifacts or inject code into later deployment steps that have GitHub token access.

Vendors: tsParticles.

Quick answers

Is CVE-2026-76826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76826 being exploited in the wild.
How severe is CVE-2026-76826?: Informational severity, published 4 November 2026.
Which products and versions are affected?: tsParticles 4.0.0 to 4.3.1.
Is there a fix for CVE-2026-76826?: Yes: fixed in 4.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76826 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-76826?: Check whether you run tsParticles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.3.2

Technical details

A GitHub Actions workflow in tsParticles 4.0.0–4.3.1 directly embeds the unquoted steps.release.outputs.body variable into an echo command in Bash, creating a shell injection vulnerability. Contributor-controlled release notes can include shell metacharacters to execute arbitrary commands during the stable publish workflow. An attacker with push access can craft a release note to compromise the workflow's GITHUB_TOKEN and modify artifacts or scripts in subsequent steps.

Affected products

tsParticles tsParticles 4.0.0 to 4.3.1

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.