CVE-2026-55675
CRITICAL 10The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Severe if exploited (CVSS 10), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 37th percentile
Impact if exploited
10CVSS 3.1 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-94: : Improper Control of Generation of Code ('Code Injection')
- CWE-829: : Inclusion of Functionality from Untrusted Control Sphere
- CWE-1357: : Reliance on Insufficiently Trustworthy Component
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
All CVSS metrics
- CRITICAL 10 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 10 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x CVE record · GitHub_M · Updated 2026-10-13T15:15:25.023Z
CVE record · CISA-ADP · Updated 2026-10-13T16:22:51.021Z
NVD · CVE-2026-55675 · Updated 2026-10-13T17:17:42.177
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98742 EUVD · EUVD-2026-98742
Technical & other
- https://github.com/saltyorg/docs/commit/649c9aea2daef1168eeb0415b44e65dbbde9f220 CVE record · GitHub_M · Updated 2026-10-13T15:15:25.023Z
NVD · CVE-2026-55675 · Updated 2026-10-13T17:17:42.177