CVE-2026-41249

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41249", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-18T03:47:03.136Z", "datePublished": "2026-06-04T19:26:46.043Z", "dateUpdated": "2026-06-08T19:15:02.639Z"}, "containers": {"cna": {"title": "CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h"}, {"name": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4"}, {"name": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14"}], "affected": [{"vendor": "coreshop", "product": "CoreShop", "versions": [{"version": ">= 5.0.1, <= 5.1.0-beta.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T19:26:46.043Z"}, "descriptions": [{"lang": "en", "value": "CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a \"Pwn Request\" vulnerability. As of time of publication, `pull_request_target` is still in the file."}], "source": {"advisory": "GHSA-q58j-g3f4-h26h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-08T19:14:42.867763Z", "id": "CVE-2026-41249", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T19:15:02.639Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41249", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T19:14:42.867763Z"}}}], "references": [{"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-08T19:14:02.495Z"}}], "cna": {"title": "CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration", "source": {"advisory": "GHSA-q58j-g3f4-h26h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coreshop", "product": "CoreShop", "versions": [{"status": "affected", "version": ">= 5.0.1, <= 5.1.0-beta.1"}]}], "references": [{"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "name": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4", "name": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14", "name": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a \"Pwn Request\" vulnerability. As of time of publication, `pull_request_target` is still in the file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-04T19:26:46.043Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41249", "state": "PUBLISHED", "dateUpdated": "2026-06-08T19:15:02.639Z", "dateReserved": "2026-04-18T03:47:03.136Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-04T19:26:46.043Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CoreShop", "vendor": "coreshop", "versions": [{"status": "affected", "version": ">= 5.0.1, <= 5.1.0-beta.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a \"Pwn Request\" vulnerability. As of time of publication, `pull_request_target` is still in the file."}, {"lang": "es", "value": "CoreShop es una soluci\u00f3n de comercio electr\u00f3nico mejorada de Pimcore. En las versiones 5.0.1 hasta 5.1.0-beta.1, el flujo de trabajo de GitHub Actions (.github/workflows/static.yml) utiliza el disparador pull_request_target pero, de forma peligrosa, extrae el c\u00f3digo no verificado de la cabecera de la solicitud de extracci\u00f3n (ref: ${{ github.event.pull_request.head.ref }}). Posteriormente, ejecuta un script (bin/console) desde esta extracci\u00f3n no confiable. Esto permite a cualquier atacante externo lograr Ejecuci\u00f3n Remota de C\u00f3digo (RCE) en el ejecutor de GitHub Actions simplemente enviando una solicitud de extracci\u00f3n maliciosa. Tambi\u00e9n conocida como vulnerabilidad 'Pwn Request'. En el momento de la publicaci\u00f3n, pull_request_target todav\u00eda est\u00e1 en el archivo."}], "id": "CVE-2026-41249", "lastModified": "2026-10-06T22:10:00.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41249", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-08T19:14:42.867763Z", "version": "2.0.3"}}]}, "published": "2026-06-04T20:16:57.797", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.1,5.1.0-beta.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CoreShop", "source": "cna", "vendor": "coreshop"}, "product": "coreshop", "vendor": "coreshop"}], "created": "2026-06-04T22:00:14.837943+00:00", "updated": "2026-06-04T23:30:25.894916+00:00", "vendors": ["coreshop", "coreshop$PRODUCT$coreshop"]}