PT-2026-22081 · Openlist · Openlist

Nilsreichardt · Publicado 2026-02-26 · Atualizado 2026-03-03 · CVE-2026-27941

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenLIT versions prior to 1.37.1

Description OpenLIT, an open source AI engineering platform, has an issue in GitHub Actions workflows prior to version 1.37.1. These workflows use the pull request target event and execute untrusted code from forked pull requests with the security context of the base repository. This includes a write-privileged GITHUB TOKEN and access to sensitive secrets such as API keys, database/vector store tokens, and a Google Cloud service account key. The pull request target event allows execution of code from potentially malicious pull requests.

Recommendations Update OpenLIT to version 1.37.1 or later.

Exploit

Correção

LPE

RCE

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2026-27941

GHSA-9JGV-X8CQ-296Q

Produtos afetados

Openlist

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27941.json · Exploit
• https://github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546c · Correção
• https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q · Aviso do Fabricante
• https://twitter.com/CveTodo/status/2026849264094073102 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787637486760430 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026983223218090347 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27941 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27941 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027004226891563445 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2026850097984610313 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2027394293187350809 · Publicação no Twitter