Vulnerabilidades de Meltano
CVEs publicadas que afetam produtos de Meltano: 1 registro(s), com severidade, exploração e correções.
CVE-2026-47690
Alta · 7.5
CWE-77 21/07/2026
MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow
MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.