CVE-2026-40316
HighSummary
OWASP BLT prior to version 2.1.1 contains an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. It uses the pull_request_target trigger, allowing malicious code execution in the CI environment with full GITHUB_TOKEN permissions.
Risk Assessment
This vulnerability can lead to arbitrary code execution in a privileged CI environment, posing a risk of secret exfiltration and exposing the organization to attacks from external contributors.
Recommendation
It is recommended to update OWASP BLT to version 2.1.1 or later to mitigate this vulnerability. Additionally, restrict the ability to apply the regenerate-migrations label by unauthorized users.
Other vulnerabilities in OWASP BLT
Original NVD description (English source)
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests into the trusted runner workspace via git show, and then executes python manage.py makemigrations, which imports Django model modules including attacker-controlled website/models.py at runtime. Any module-level Python code in the attacker's models.py is executed during import, enabling arbitrary code execution in the privileged CI environment with access to GITHUB_TOKEN and repository secrets. The attack is triggerable by any external contributor who can open a pull request, provided a maintainer applies the regenerate-migrations label, potentially leading to secret exfiltration, repository co