CVE-2026-44359

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44359", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T20:15:20.630Z", "datePublished": "2026-07-19T23:06:32.005Z", "dateUpdated": "2026-07-24T03:56:28.416Z"}, "containers": {"cna": {"title": "Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736"}, {"name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96", "tags": ["x_refsource_MISC"], "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96"}, {"name": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5", "tags": ["x_refsource_MISC"], "url": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5"}, {"name": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing", "tags": ["x_refsource_MISC"], "url": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing"}], "affected": [{"vendor": "meshtastic", "product": "firmware", "versions": [{"version": "< 2.7.21.1370b23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-19T23:06:32.005Z"}, "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: \"NONE\" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue."}], "source": {"advisory": "GHSA-mjx5-98jq-q736", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-44359"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T03:56:28.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44359", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-20T19:06:04.914895Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:06:13.520Z"}}], "cna": {"title": "Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow", "source": {"advisory": "GHSA-mjx5-98jq-q736", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "meshtastic", "product": "firmware", "versions": [{"status": "affected", "version": "< 2.7.21.1370b23"}]}], "references": [{"url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736", "name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96", "name": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5", "name": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5", "tags": ["x_refsource_MISC"]}, {"url": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing", "name": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: \"NONE\" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-19T23:06:32.005Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44359", "state": "PUBLISHED", "dateUpdated": "2026-07-24T03:56:28.416Z", "dateReserved": "2026-05-05T20:15:20.630Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-19T23:06:32.005Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "firmware", "vendor": "meshtastic", "versions": [{"status": "affected", "version": "< 2.7.21.1370b23"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: \"NONE\" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue."}, {"lang": "es", "value": "Meshtastic es una soluci\u00f3n de red mallada de c\u00f3digo abierto. Antes de la versi\u00f3n 2.7.21.1370b23, el flujo de trabajo main_matrix.yml del repositorio de GitHub de Meshtastic se activaba mediante pull_request_target y m\u00faltiples trabajos extra\u00edan el c\u00f3digo del fork del atacante y lo ejecutaban con acceso a los secretos del repositorio y permisos elevados de GITHUB_TOKEN. No exist\u00eda una puerta de aprobaci\u00f3n. Las solicitudes de extracci\u00f3n de usuarios externos con author_association: \u2019NONE\u2019 activaban autom\u00e1ticamente el flujo de trabajo de CI. El flujo de trabajo ejecutaba directamente archivos controlados por el atacante desde la extracci\u00f3n del fork. Este problema podr\u00eda haber resultado en un compromiso de la cadena de suministro, un compromiso del runner autoalojado y/o una toma de control del repositorio. Este problema es independiente de GHSA-6mwm-v2vv-pp96, que abord\u00f3 una inyecci\u00f3n de comandos a trav\u00e9s de github.head_ref en el trabajo de configuraci\u00f3n del mismo flujo de trabajo. Esa correcci\u00f3n se movi\u00f3 correctamente a variables de entorno. Sin embargo, la vulnerabilidad m\u00e1s cr\u00edtica de extracci\u00f3n del fork en los trabajos de check, build y build-debian-src no fue abordada. La versi\u00f3n 2.7.21.1370b23 contiene un parche para este problema."}], "id": "CVE-2026-44359", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44359", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-20T00:16:58.210", "references": [{"source": "security-advisories@github.com", "url": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing"}, {"source": "security-advisories@github.com", "url": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5"}, {"source": "security-advisories@github.com", "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96"}, {"source": "security-advisories@github.com", "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.7.21.1370b23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "firmware", "source": "cna", "vendor": "meshtastic"}, "product": "firmware", "vendor": "meshtastic"}], "created": "2026-07-20T22:45:17.215371+00:00", "updated": "2026-07-30T20:00:20.065259+00:00", "vendors": ["meshtastic", "meshtastic$PRODUCT$firmware"]}