CVE Intelligence
Analysis AI-assisted

CVE-2026-55675: Saltyorg Docs CI workflow code injection via fork-controlled Python build hooks

A CI workflow for the Saltyorg Docs site can run attacker-authored build code from a fork pull request inside a privileged workflow that has deployment secrets. The record classifies this as CWE-94 with a CVSS 3.1 score of 10 and a fix in commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. The KEV catalog does not list this CVE and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Saltyorg documentation repository builds and deploys the docs.saltbox.dev website. According to the record, a pull request from a fork can cause the privileged base-repository workflow to run code from the fork commit, which can expose deployment secrets. The weakness is classified as CWE-94 (Code Injection) and is fixed in commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

Impact

  • The record describes exposure of CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY and a write-capable GITHUB_TOKEN to code supplied by an untrusted fork.
  • The record gives a CVSS 3.1 score of 10 (Critical) with high confidentiality, integrity and availability impact, requiring no privileges and no user interaction.
  • The record mentions possible follow-on compromise. Its extent is not described in the available information.

Affected products and versions

  • Saltyorg Docs, versions before commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, according to the record.
  • The record does not list a separate fixed version; the fixing commit is the reference point.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source. No confirmed exploitation appears in the sources consulted. The SSVC field in the record lists exploitation as poc, which indicates a proof-of-concept level and is not evidence of exploitation in the wild. No EPSS data is present.

Remediation and mitigation

  • Confirm that the documentation repository includes the fix from commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 or a later revision.
  • Review whether the deployment and publishing secrets listed in the record could have been exposed, and rotate them as a precaution.
  • Restrict workflow token permissions to the minimum needed for publishing.
  • Treat pull requests from forks as untrusted input whenever a workflow they trigger has access to secrets.

Detection guidance

  • Review CI run history for pull requests from forks that triggered build workflows before the fix.
  • Look for unexpected changes to build or dependency configuration in fork pull requests.
  • Review audit logs for token use that falls outside expected publishing activity.

Limitations of the available information

  • The record does not state whether any deployment was affected or whether any secret was actually exposed.
  • The source status is Deferred and no EPSS score is available.
  • Details beyond the record and the cited advisory and commit were not independently verified.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC field lists exploitation as poc, which is a proof-of-concept level and not confirmed exploitation in the wild.

What should maintainers do first?

Confirm the repository includes commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 or a later revision, then review whether listed deployment secrets could have been exposed and rotate them as a precaution.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.