CVE-2026-31852 - Vulnerability Analysis

Overview

Jellyfin jellyfin-ios contains an arbitrary code execution vulnerability in the code-quality.yml GitHub Actions workflow due to elevated permissions, letting attackers via forked pull requests fully compromise the repository and organization, exploit requires pull request from forked repository.

Severity & Score

Impact

Attackers can fully compromise the repository, exfiltrate secrets, poison packages, and compromise the entire organization.

Mitigation

No update required; end users do not need to take any actions as this is a workflow configuration issue.

References

• https://github.com/jellyfin/jellyfin-ios/commit/109217e75f38394b2f6e46e25dfe5a721203d3c8
• https://github.com/jellyfin/jellyfin-ios/security/advisories/GHSA-7qhm-2m45-7fmh

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 11, 2026

🔴 CVE-2026-31852 - Critical (10) Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31852/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner