CVE Intelligence
Analysis AI-assisted

CVE-2026-22869: Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow

CVE-2026-22869 affects Eigent, a multi-agent Workforce, through a CI workflow that combines the pull_request_target trigger with checkout of untrusted pull request code. According to the record, this can allow code execution from fork pull requests that have repository write permissions. NVD scores it 9.8, CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Eigent is described in the record as a multi-agent Workforce. The issue concerns its CI workflow at .github/workflows/ci.yml, which uses the pull_request_target trigger together with checkout of untrusted pull request code. The assigned weakness is CWE-94, Code Injection.

Impact

  • The record states that code execution is possible from fork pull requests that have repository write permissions.
  • The listed possible consequences are stealing credentials, posting comments, pushing code and creating releases.
  • NVD assigns a base score of 9.8. GitHub assigns 8.9. The SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • Eigent (product entry 'Eigent Eigent'): versions before 0.0.78 are listed as affected.
  • Eigent-ai Eigent: the affected boundary is expressed as a commit reference, and the record gives no version number for this entry.
  • The record links a patch commit and pull request 837 as fixes.
  • Inference: 0.0.78 is the upper boundary of the affected range, so later releases are presumably not affected. The record does not explicitly confirm 0.0.78 as the fixed release.

Exploitation status

  • CISA KEV does not list this CVE, so no active exploitation is claimed here.
  • The record gives an EPSS probability of 0.00635 and a percentile of 0.49813. The SSVC exploitation field is none.
  • No confirmed exploitation appears in the sources consulted. Some references carry an Exploit tag, which describes the reference category and does not confirm real-world use.

Remediation and mitigation

  • Upgrade Eigent to 0.0.78 or a later release, and confirm that the patch commit is included in the deployed build.
  • Review every workflow that uses pull_request_target and make sure untrusted pull request code is not checked out with privileged tokens or secrets.
  • Restrict the default token permissions of CI workflows to the minimum needed.
  • Review secrets that the CI environment can access and rotate them if there is any doubt about exposure.

Detection guidance

  • Review CI runs triggered by pull requests from forks, especially those that ran with elevated permissions.
  • Audit recent comments, pushes, tags and releases for changes that were not made by maintainers.
  • Check audit logs for unexpected use of repository tokens or secrets.

Limitations of the available information

  • The record does not describe exploitation steps, and this analysis does not provide them.
  • The exact version range for the Eigent-ai entry is unknown because it is given only as a commit reference.
  • Whether any real-world exploitation occurred is unknown.
  • The record does not state whether a given repository's own workflow configuration matches the vulnerable file.

Frequently asked questions

Which Eigent versions are affected?

The record lists versions before 0.0.78 for the Eigent product. A second entry for Eigent-ai uses a commit reference instead of a version number.

Is this vulnerability known to be exploited?

CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

What should maintainers do?

Upgrade to 0.0.78 or a later release and review every workflow that uses pull_request_target, especially checkouts of untrusted pull request code.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.