CVE-2026-24480
Unknown Unknown - Not Provided
Remote Code Execution via GitHub Actions in QGIS Workflow

Publication date: 2026-01-27

Last updated on: 2026-01-27

Assigner: GitHub, Inc.

Description
QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it used the `pull_request_target` trigger and then checked out and executed untrusted pull request code in a privileged context. Workflows triggered by `pull_request_target` ran with the base repository's credentials and access to secrets. If these workflows then checked out and executed code from the head of an external pull request (which could have been attacker controlled), the attacker could have executed arbitrary commands with elevated privileges. This insecure pattern has been documented as a security risk by GitHub and security researchers. Commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 removed the vulnerable code.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-27
Last Modified
2026-01-27
Generated
2026-05-07
AI Q&A
2026-01-27
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
qgis qgis *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include: 1) Replace the `pull_request_target` trigger with `pull_request` in your GitHub Actions workflows that execute pull request code, as `pull_request` runs with the pull request author's permissions and does not expose secrets. 2) Remove or disable any workflow steps that automatically push fixes or create branches/PRs in response to pull request comments (e.g., `/fix-precommit`). 3) Restrict workflow token permissions to the minimum necessary, avoiding broad write access. 4) Avoid executing untrusted code in workflows that have access to secrets or elevated privileges. 5) Consider separating privileged operations from untrusted code execution using multi-stage workflows or secure gates. 6) Conduct a thorough audit of all workflow runs, git history, release artifacts, and secrets to detect and remediate any compromise. [1, 2]


Can you explain this vulnerability to me?

CVE-2026-24480 is a critical remote code execution and repository takeover vulnerability in the QGIS GitHub Actions workflow called "pre-commit checks." The workflow used the `pull_request_target` trigger, which runs with the base repository's elevated privileges and access to secrets. It then checked out and executed untrusted code from external pull requests in this privileged context. This allowed an attacker controlling the pull request code to execute arbitrary commands with elevated permissions, potentially compromising the repository and its CI/CD pipeline. [1]


How can this vulnerability impact me? :

This vulnerability can lead to arbitrary code execution with elevated privileges on GitHub Actions runners, allowing attackers to exfiltrate secrets and tokens, push malicious commits, create branches, modify workflow files or CI/CD configurations, and open or modify pull requests programmatically. This results in complete compromise of repository integrity and CI/CD pipelines. Packages and releases built during the vulnerable period may be compromised with backdoors or tampered artifacts. [1]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

To detect this vulnerability, you should audit your GitHub Actions workflows for the use of the `pull_request_target` event trigger, especially in workflows that check out and execute code from pull requests. Look for workflows named "pre-commit checks" or similar that run commands like `pre-commit run --files ${MODIFIED_FILES[@]}` on pull request code. Additionally, review workflow permissions for broad write access such as `contents: write`, `issues: write`, and `pull-requests: write`. There are no specific commands provided, but you can manually inspect your `.github/workflows/` YAML files for these patterns. Also, audit your git history, release artifacts, and secrets for signs of compromise as recommended. [1]


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability allows attackers to execute arbitrary code with elevated privileges and exfiltrate secrets and tokens from the repository environment. This can lead to unauthorized access to sensitive data and compromise of repository integrity, which may result in violations of data protection regulations such as GDPR and HIPAA. Organizations using the affected workflows could face compliance risks due to potential data breaches and unauthorized data manipulation. Therefore, this vulnerability negatively impacts compliance with common standards and regulations by increasing the risk of unauthorized data access and loss of data integrity. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart