CVE-2026-34243
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
wenxian versions 0.3.1 and prior contain a command injection vulnerability in a GitHub Actions workflow. Untrusted user input from issue_comment.body is used directly inside a shell command, allowing potential arbitrary code execution on the runner. At the time of publication, no public patches are available.
Risk Assessment
Risk includes compromise of the GitHub Actions runner, leading to theft of repository secrets and modification of build artifacts.
Recommendation
Discontinue use of wenxian until a patch is released, or temporarily disable the workflow that uses issue_comment.body.
Original NVD description (English source)
wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.