PT-2026-21922 · Live Codes · Livecode

Nekros1Xx · Publicado 2026-02-25 · Atualizado 2026-02-28 · CVE-2026-27701

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions LiveCode versions prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11

Description LiveCode is an open-source, client-side code playground. The i18n-update-pull GitHub Actions workflow is susceptible to JavaScript injection prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11. The title of a Pull Request is directly interpolated into a JavaScript block within the actions/github-script action using a GitHub Actions template expression. An attacker can inject arbitrary JavaScript by creating a Pull Request with a specially crafted title. This injected JavaScript executes with the permissions of the CI bot token (CI APP ID / CI APP PRIVATE KEY), potentially allowing for the exfiltration of repository secrets and unauthorized operations via the GitHub API.

Recommendations Update LiveCode to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-27701

GHSA-XH9W-5859-X97J

Produtos afetados

Livecode

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27701.json · Exploit
• 🔥 https://github.com/live-codes/livecodes/security/advisories/GHSA-xh9w-5859-x97j · Exploit
• https://github.com/live-codes/livecodes/commit/e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 · Nota
• https://twitter.com/CVEnew/status/2027744288113611181 · Publicação no Twitter
• https://t.me/cveNotify/153477 · Publicação no Telegram
• https://t.me/CVEtracker/45746 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-27701 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27701 · Aviso do Fabricante