CVE-2026-24480
Remote Code Execution via GitHub Actions in QGIS Workflow
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qgis | qgis | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Replace the `pull_request_target` trigger with `pull_request` in your GitHub Actions workflows that execute pull request code, as `pull_request` runs with the pull request author's permissions and does not expose secrets. 2) Remove or disable any workflow steps that automatically push fixes or create branches/PRs in response to pull request comments (e.g., `/fix-precommit`). 3) Restrict workflow token permissions to the minimum necessary, avoiding broad write access. 4) Avoid executing untrusted code in workflows that have access to secrets or elevated privileges. 5) Consider separating privileged operations from untrusted code execution using multi-stage workflows or secure gates. 6) Conduct a thorough audit of all workflow runs, git history, release artifacts, and secrets to detect and remediate any compromise. [1, 2]
Can you explain this vulnerability to me?
CVE-2026-24480 is a critical remote code execution and repository takeover vulnerability in the QGIS GitHub Actions workflow called "pre-commit checks." The workflow used the `pull_request_target` trigger, which runs with the base repository's elevated privileges and access to secrets. It then checked out and executed untrusted code from external pull requests in this privileged context. This allowed an attacker controlling the pull request code to execute arbitrary commands with elevated permissions, potentially compromising the repository and its CI/CD pipeline. [1]
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution with elevated privileges on GitHub Actions runners, allowing attackers to exfiltrate secrets and tokens, push malicious commits, create branches, modify workflow files or CI/CD configurations, and open or modify pull requests programmatically. This results in complete compromise of repository integrity and CI/CD pipelines. Packages and releases built during the vulnerable period may be compromised with backdoors or tampered artifacts. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should audit your GitHub Actions workflows for the use of the `pull_request_target` event trigger, especially in workflows that check out and execute code from pull requests. Look for workflows named "pre-commit checks" or similar that run commands like `pre-commit run --files ${MODIFIED_FILES[@]}` on pull request code. Additionally, review workflow permissions for broad write access such as `contents: write`, `issues: write`, and `pull-requests: write`. There are no specific commands provided, but you can manually inspect your `.github/workflows/` YAML files for these patterns. Also, audit your git history, release artifacts, and secrets for signs of compromise as recommended. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to execute arbitrary code with elevated privileges and exfiltrate secrets and tokens from the repository environment. This can lead to unauthorized access to sensitive data and compromise of repository integrity, which may result in violations of data protection regulations such as GDPR and HIPAA. Organizations using the affected workflows could face compliance risks due to potential data breaches and unauthorized data manipulation. Therefore, this vulnerability negatively impacts compliance with common standards and regulations by increasing the risk of unauthorized data access and loss of data integrity. [1]