CVE-2026-42603

High

Published: 11/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Prior to version 2.1.2, OWASP BLT contained a vulnerability where the .github/workflows/pre-commit-fix.yaml file used pull_request_target, allowing code execution from the attacker's fork, enabling remote code execution (RCE) with write permissions.

Risk Assessment

Organizations using OWASP BLT prior to version 2.1.2 were exposed to attacks that could lead to remote code execution, potentially resulting in serious security implications for their systems.

Recommendation

It is recommended to upgrade OWASP BLT to version 2.1.2 or later to mitigate this vulnerability and secure the system against potential attacks.

Other vulnerabilities in OWASP BLT

CVE-2026-40316High
OWASP BLT prior to version 2.1.1 contains an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. It uses the pull_request_target trigger, allowing malicious code execution in the CI environment with full GITHUB_TOKEN permissions.

Original NVD description (English source)

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and executes code directly from the attacker's fork, enabling RCE with write permissions. This vulnerability is fixed in 2.1.2.