CVE-2026-40316

HighCVSS 8.8

Published: 15/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

35th percentile - higher than 35% of all known CVEs

Summary

OWASP BLT versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests, and executes python manage.py makemigrations, which imports a malicious models.py and executes arbitrary code.

Risk Assessment

An external contributor can trigger code execution in a privileged CI environment with access to GITHUB_TOKEN and repository secrets, potentially leading to secret exfiltration, repository compromise, and supply chain attacks.

Recommendation

Upgrade OWASP BLT to version 2.1.1 or later. Review and restrict CI workflow permissions and avoid executing untrusted code in the pull_request_target context.

Other vulnerabilities in OWASP BLT

CVE-2026-42603High
Prior to version 2.1.2, OWASP BLT contained a vulnerability where the .github/workflows/pre-commit-fix.yaml file used pull_request_target, allowing code execution from the attacker's fork, enabling remote code execution (RCE) with write permissions.

Original NVD description (English source)

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests into the trusted runner workspace via git show, and then executes python manage.py makemigrations, which imports Django model modules including attacker-controlled website/models.py at runtime. Any module-level Python code in the attacker's models.py is executed during import, enabling arbitrary code execution in the privileged CI environment with access to GITHUB_TOKEN and repository secrets. The attack is triggerable by any external contributor who can open a pull request, provided a maintainer applies the regenerate-migrations label, potentially leading to secret exfiltration, repository compromise, and supply chain attacks. A patch for this issue is expected to be released in version 2.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS