CVE-2026-55675
Deferred Deferred - Pending Action

Arbitrary Code Execution in Salty Documentation Repository

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-13
EPSS Evaluated
2026-10-18
NVD
CVE-2026-55675
EUVD
EUVD-2026-98742

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
saltyorg docs < 649c9aea2daef1168eeb0415b44e65dbbde9f220

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1357 The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in the Salty documentation repository's CI/CD pipeline. It involves a two-workflow chain where an attacker can inject malicious code via a forked pull request. The attacker-controlled setup.py or build hooks execute during pip install in a privileged workflow, allowing secret disclosure and further compromise.

Detection Guidance

This vulnerability is specific to GitHub Actions workflows in the saltyorg/docs repository. It cannot be detected on general networks or systems as it requires checking the workflow files in the repository for the vulnerable commit hash (649c9aea2daef1168eeb0415b44e65dbbde9f220) or the presence of the old workflow structure. Review the .github/workflows/ directory for files like trigger-pr-build.yml and build-pr.yml.

Impact Analysis

An attacker could steal sensitive secrets like API tokens, GitHub tokens, or Cloudflare credentials. This could lead to unauthorized access, data breaches, or further attacks on the repository or associated services. The impact includes full system compromise due to the high privileges of the affected workflows.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosure, or loss of control over personal or health information, leading to legal and regulatory penalties.

Mitigation Strategies

Update the saltyorg/docs repository to include commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 or later. Verify that the workflows have been restructured to separate build and deployment steps, ensuring untrusted fork code runs in an unprivileged context without access to secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart