CVE-2026-22869

Critical

Published: 13/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Eigent, a multi-agent workforce, has a critical security vulnerability in its CI workflow (.github/workflows/ci.yml) that allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pull_request_target trigger combined with checkout of untrusted PR code. An attacker can exploit this to steal credentials, post comments, push code, or create releases.

Risk Assessment

The vulnerability could lead to repository takeover, theft of CI/CD secrets, modification of source code, or publication of malicious releases, threatening project integrity and user security.

Recommendation

Modify the CI workflow to avoid using pull_request_target with checkout of untrusted code. Apply secure patterns such as verifying PR origin or using separate environments.

Original NVD description (English source)

Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pull_request_target trigger combined with checkout of untrusted PR code. An attacker can exploit this to steal credentials, post comments, push code, or create releases.