CVE-2026-94620

Prior to version 1.11.0 , the Classroom 50 tool is vulnerable to an arbitrary file write when using the gh teacher download command. The root cause is that the tool follows symlinks when writing autograde artifacts (result.json and results.json) into a student's cloned repository. An attacker can...