CVE-2026-42603

creationtimestamp| type| source ---|---|--- 2026-05-11 17:27:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllsbhyynu2l 2026-05-11 17:27:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllsbhyynu2l...

CVE-2026-42603 OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pullrequesttarget privileged trigger but checks out and executes code directly from the attacker's fork, enabling...