tanstack-shield

🛡️ tanstack-shield One-command supply-chain attack scanner for CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Detects the "Mini Shai-Hulud" worm that compromised 42 @tanstack/ npm packages 84 malicious versions on May 11, 2026. One line — scan your project curl -fsSL...

CVE-2026-44590

CVE-2026-44590 - sherlock-project/sherlock CI - RCE via pullrequesttarget Injection → Supply Chain Compromise Discovered & reported by: Astaruf Full writeup: https://nstsec.com/en/posts/sherlock-rce-pull-request-target-cve-2026-44590/ Upstream advisory: sherlock-project/sherlock GHSA advisory NVD...

CVE-2026-54532

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

CVE-2026-54532 CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

EUVD-2026-108260

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

CVE-2026-54532 CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pullrequesttarget workflow is vulnerable to cache poisoning and OIDC token theft. A pullrequesttarget workflow checks out fork code using github.event.pullrequest.head.sha or .head.ref. This gives...

CVE-2026-54532

CloudPirates Open Source Helm Charts are vulnerable to cache poisoning and OIDC token theft in the pull_request_target workflow prior to commit 271d415 . The root cause is that the workflow checks out code from forks using github.event.pull_request.head.sha or .head.ref, granting attacker-control...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

EUVD-2026-101106

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800

Gitea is vulnerable to an improper control of generation of code (CWE-94) and inclusion of functionality from untrusted control sphere (CWE-829) when handling pull_request_target events. The flaw occurs because the system resolves local reusable workflow files from a fork's head commit while exec...

CVE-2026-73800: Improper Control of Generation of Code

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows | Cloud Foundry

Severity CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ---|--- Vendor CloudFoundry Foundation Versions Affected The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected. Description GitHub Actions workflows were configured to trigger on pullrequesttarg...

CVE-2026-55563

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563

Feast , an open-source feature store for AI/ML, is vulnerable in versions prior to 0.65.0 through its GitHub Actions workflow (.github/workflows/pr_integration_tests.yml). The workflow uses pull_request_target with the synchronize event and preserves approval labels (ok-to-test, approved, lgtm) a...