PT-2026-43300 · Vowpalwabbit · Vowpal Wabbit

Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-44723

NVD

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python checks.yml embeds ${{ github.event.pull request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run tests model gen and load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

CWE-1336

Related Identifiers

CVE-2026-44723

Affected Products

Vowpal Wabbit

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-44723 · Security Note
• https://github.com/VowpalWabbit/vowpal_wabbit/commit/998e390e80a7e8192d7849b7784bc113dbd190ad · Note
• https://github.com/VowpalWabbit/vowpal_wabbit/security/advisories/GHSA-cg2g-xgg7-3xxq · Note