PT-2026-33183 · Owasp Blt · Owasp Blt

Savio Dsouza · Published 2026-04-15 · Updated 2026-05-21 · CVE-2026-40316

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OWASP BLT versions prior to 2.1.1

Description An issue exists in the '.github/workflows/regenerate-migrations.yml' workflow where the 'pull request target' trigger runs with full GITHUB TOKEN write permissions. The workflow copies files from untrusted pull requests into the trusted runner workspace using 'git show' and executes 'python manage.py makemigrations'. This process imports Django model modules, including an attacker-controlled website/models.py, at runtime. Any module-level Python code within the attacker's models.py is executed during import, allowing arbitrary code execution in the privileged CI environment. This provides access to the GITHUB TOKEN and repository secrets. The issue can be triggered by an external contributor opening a pull request if a maintainer applies the 'regenerate-migrations' label, which may lead to secret exfiltration, repository compromise, and supply chain attacks. This issue is under active exploitation.

Recommendations Update to version 2.1.1.

Fix

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2026-40316

Affected Products

Owasp Blt

References · 6

• https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-wxm3-64fx-cmx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40316 · Security Note
• https://twitter.com/NewsNerdie/status/2044778462569812081 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044674272153436469 · Twitter Post
• https://t.me/cveNotify/164444 · Telegram Post
• https://twitter.com/CVEnew/status/2044701605405327645 · Twitter Post