Description

Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In the documented pull_request_target configuration, an attacker can open a pull request, including from a fork, whose branch name contains shell metacharacters, and the workflow automatically interprets those characters as commands without maintainer interaction. The commands execute on a runner with base-repository secrets and a write-scoped GITHUB_TOKEN, allowing arbitrary command execution, secret or token exfiltration, unauthorized pushes, and other token abuse. The fixed implementations in src/index.ts and src/conflibot.ts use execFile or spawn argument arrays, and the v2 line also uses numeric pull-request refs rather than branch names. This issue is fixed in versions 1.2.1 and 2.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-15T15:17:18.593Z",
  "pubdate": "2026-09-15T15:17:18.593Z",
  "executiveSummary": "Conflibot versions prior to 1.2.1 and 2.0.0 contain a critical Command Injection vulnerability originating from improper input sanitization of pull request branch references. The vulnerability exists within the application's core logic where user-supplied input is directly concatenated into system shell commands.\nBy crafting a malicious branch name containing shell metacharacters, an attacker can achieve arbitrary remote code execution (RCE) on the runner environment. Because this occurs within the pull_request_target workflow context, the impact is severe, granting the attacker access to base-repository secrets, write-scoped GITHUB_TOKEN credentials, and the ability to perform unauthorized repository modifications.\nThe flaw allows unauthenticated attackers—including those submitting pull requests from forks—to trigger command execution without maintainer interaction. This represents a significant risk to the integrity and confidentiality of the project repository and associated infrastructure. Remediation requires updating to the patched versions, which migrate from unsafe shell command interpolation to secure execution methods utilizing argument arrays.",
  "technicalDetails": "The root cause of this vulnerability is the insecure construction of shell commands in src/index.ts. The application logic captures the head.ref attribute from a GitHub pull request and interpolates this string directly into command strings executed via exec. By design, the exec function triggers a shell, making it susceptible to command injection when the input is not sanitized or escaped.\nThe attack flow initiates when an attacker creates a branch name populated with shell metacharacters (e.g., ';', '&', '|', '$(...)'). When the Conflibot workflow triggers—specifically under the pull_request_target context—the application retrieves this malicious branch string and passes it into git checkout, git merge, or git format-patch commands. The underlying shell interprets the injected characters as command delimiters, effectively breaking out of the intended git context and executing arbitrary payloads with the privileges of the runner process.\nThe runner environment is highly sensitive, as it typically possesses access to base-repository secrets and a GITHUB_TOKEN with write permissions. Successful exploitation results in full control over the CI/CD environment. Potential post-exploitation activities include the exfiltration of sensitive environment variables and secrets, modification of the repository source code to inject backdoors, or the use of the write-scoped token to bypass branch protection rules and push unauthorized commits to protected branches.\nAffected versions include all releases prior to 1.2.1 and 2.0.0. The vulnerability is prevalent due to the reliance on unsanitized branch name references for system-level git operations. The remediation strategy implemented in versions 1.2.1 and 2.0.0 addresses the root cause by abandoning command string interpolation. Instead, the developers transitioned to using execFile or spawn with argument arrays, which ensures that input is treated strictly as a literal argument rather than part of a command sequence. Furthermore, the 2.0.0 release enhances security by utilizing numeric pull-request refs, which inherently mitigates the risks associated with branch name manipulation."
}