PT-2026-114276

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull request target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to...