CVE-2026-40316 - Vulnerability Analysis

Overview

OWASP BLT < 2.1.1 contains a remote code execution caused by unsafe use of pull_request_target trigger and importing attacker-controlled Python modules in .github/workflows/regenerate-migrations.yml, letting external contributors execute arbitrary code with GITHUB_TOKEN and repository secrets, exploit requires a maintainer to apply the regenerate-migrations label.

Severity & Score

Impact

External contributors can execute arbitrary code in CI with full repository secrets, leading to secret exfiltration and repository compromise.

Mitigation

Update to version 2.1.1 or later.

References

• https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-wxm3-64fx-cmx9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner