CVE-2026-76826

Received Received - Intake

Remote Code Execution in tsParticles Stable Release Workflow

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-76826

Affected Vendors & Products

Vendor	Product	Version / Range
tsparticles	tsparticles	>= 4.0.0, < 4.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the tsParticles library between versions 4.0.0 and 4.3.2. It involves a flaw in the stable publish workflow where shell metacharacters in release-note text can execute arbitrary commands during a release process. This happens because the workflow interpolates user-controlled text directly into a Bash echo command without proper sanitization.

Detection Guidance

This vulnerability involves malicious shell metacharacters in release-note text that execute during a stable release process. To detect it, inspect the generated RAW_RELEASE.md file for unexpected commands or shell metacharacters in the release notes before publishing. Check for unusual characters like semicolons, backticks, or command substitutions.

Impact Analysis

If you use a vulnerable version of tsParticles, an attacker could inject malicious commands into release notes. When a maintainer publishes a stable release, these commands could execute, potentially modifying artifacts, altering workspace scripts, or gaining access to sensitive permissions like GITHUB_TOKEN.

Mitigation Strategies

Upgrade to version 4.3.2 or later of tsParticles to apply the fix. Review release notes for suspicious content before publishing. Avoid using untrusted release notes in the stable publish workflow. Validate all inputs to prevent shell injection.

Hi! I’m here to help you understand CVE-2026-76826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...