PT-2026-43300 · Vowpalwabbit · Vowpal Wabbit

Datosh · Publicado 2026-05-26 · Atualizado 2026-05-26 · CVE-2026-44723

NVD

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python checks.yml embeds ${{ github.event.pull request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run tests model gen and load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-1336

CWE-78

Identificadores relacionados

CVE-2026-44723

Produtos afetados

Vowpal Wabbit

Referências · 3

• 🔥 https://github.com/VowpalWabbit/vowpal_wabbit/security/advisories/GHSA-cg2g-xgg7-3xxq · Exploit
• https://github.com/VowpalWabbit/vowpal_wabbit/commit/998e390e80a7e8192d7849b7784bc113dbd190ad · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-44723 · Nota de Segurança