# CVE-2026-76826: tsParticles shell injection in stable publish workflow

Source: https://junglewise.ai/threats/cve-2026-76826-tsparticles-is-a-typescript-library-for-creating-highly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-76826 · Severity: info · Published 2026-11-04

tsParticles is a TypeScript library for creating particle animations. The stable release workflow unsafely interpolates contributor-controlled release notes into a Bash command, allowing malicious shell metacharacters to execute arbitrary code when a maintainer publishes a release. An attacker with commit access could modify release artifacts or inject code into later deployment steps that have GitHub token access.

Vendors: [tsParticles](https://junglewise.ai/threats/vendors/tsparticles).

## Quick answers

**Is CVE-2026-76826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76826 being exploited in the wild.

**How severe is CVE-2026-76826?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** tsParticles 4.0.0 to 4.3.1.

**Is there a fix for CVE-2026-76826?** Yes: fixed in 4.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76826 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76826?** Check whether you run tsParticles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.3.2

## Technical details

A GitHub Actions workflow in tsParticles 4.0.0–4.3.1 directly embeds the unquoted steps.release.outputs.body variable into an echo command in Bash, creating a shell injection vulnerability. Contributor-controlled release notes can include shell metacharacters to execute arbitrary commands during the stable publish workflow. An attacker with push access can craft a release note to compromise the workflow's GITHUB_TOKEN and modify artifacts or scripts in subsequent steps.

## Affected products

- tsParticles tsParticles 4.0.0 to 4.3.1

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896](https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896)
- [https://github.com/tsparticles/tsparticles/pull/5888](https://github.com/tsparticles/tsparticles/pull/5888)