PT-2026-24746 · Jellyfin+1 · Code-Quality.Yml+2

Barakharyati · Published 2026-03-11 · Updated 2026-05-20 · CVE-2026-31852

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jellyfin versions (affected versions not specified)

Description Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in the jellyfin/jellyfin-ios repository is susceptible to arbitrary code execution through pull requests originating from forked repositories. The workflow possesses elevated permissions, granting nearly all write access. This allows for complete takeover of the jellyfin/jellyfin-ios repository, potential exfiltration of sensitive secrets, a possible Apple App Store supply chain attack, compromise of GitHub Container Registry (ghcr.io) packages, and full compromise of the Jellyfin organization through cross-repository token usage. This is a workflow issue, not a code-level flaw.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-31852

GHSA-7QHM-2M45-7FMH

Affected Products

Code-Quality.Yml

Jellyfin

Jellyfin-Ios

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31852.json · Exploit
• https://github.com/jellyfin/jellyfin-ios/commit/109217e75f38394b2f6e46e25dfe5a721203d3c8 · Patch
• https://github.com/jellyfin/jellyfin-ios/security/advisories/GHSA-7qhm-2m45-7fmh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31852 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31852 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031992408339333628 · Twitter Post
• https://twitter.com/HugoValters/status/2057168116036022471 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031781656651317623 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031993995878932541 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031783195272683959 · Twitter Post
• https://t.me/CVEtracker/47153 · Telegram Post
• https://twitter.com/CveFindCom/status/2031787704258633845 · Twitter Post