Home / Vulnerability Intelligence / CVE-2026-42603

CVE-2026-42603 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: May 11, 2026

OWASP BLT - Remote Code Execution

Published: May 11, 2026Updated: May 11, 2026Remote Exploitable

Overview

OWASP BLT < 2.1.2 contains a remote code execution caused by use of pull_request_target with code checkout from attacker forks in .github/workflows/pre-commit-fix.yaml, letting attackers with write permissions execute arbitrary code remotely, exploit requires write access to repository.

Severity & Score

Severity: High

CVSS Score: 8.8

EPSS Score: 4.2%(Probability of exploitation in next 30 days)

Impact

Attackers with write permissions can execute arbitrary code remotely, potentially compromising the CI environment and codebase.

Mitigation

Update to version 2.1.2 or later.

References

https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-cgvj-qg2h-cqfh

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

May 11, 2026

🟠 CVE-2026-42603 - High (8.8) OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and exe... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42603/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

May 11, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-42603
Severity: High
CVSS Score: 8.8
Type: remote_code_execution
Status: new
EPSS: 4.2%
Social Posts: 2

CWE

CWE-94

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

4.2%Probability of exploitation in the next 30 days