p PatchFirst

CVE-2026-27941

CVE-2026-27941 · OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

CVSS 10.0 · Crítica · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • openlit

    Versiones
    • < 1.37.1: Afectada

    Sin corrección publicada

  • openlit PyPI

    Versiones
    • 1.36.2
    • 1.36.3
    • 1.36.6
    • 1.36.7
    • 1.36.8
    • 1.36.9
    • 1.37.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 1.36.2, < 1.37.1

    Actualiza a 1.37.1

Fuentes originales

Comprueba tu servidor →