CVE-2026-41249
Remote Code Execution in CoreShop via GitHub Actions
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| coreshop | coreshop | From 5.0.1 (inc) to 5.1.0-beta.1 (inc) |
| coreshop | coreshop | 5.1.0-beta.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41249 is a critical Remote Code Execution (RCE) vulnerability in CoreShop's GitHub Actions workflow. The workflow uses the `pull_request_target` trigger but dangerously checks out unverified code from the pull request head and executes a script from this untrusted source. This allows an external attacker to submit a malicious pull request that runs arbitrary code on the GitHub Actions runner.
The vulnerability arises because `pull_request_target` runs in the context of the base repository, granting access to sensitive secrets and permissions. An attacker can exploit this by forking the repository, modifying files to trigger the workflow, replacing scripts with malicious payloads, and submitting a pull request that executes the payload.
This issue is also known as a "Pwn Request" vulnerability and is classified as CWE-94 (Code Injection).
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on the GitHub Actions runner, effectively gaining full control over the runner's environment.
- Attackers can exfiltrate sensitive secrets such as `PIMCORE_SECRET` or `PIMCORE_PRODUCT_KEY`.
- They can modify repository contents if permissions allow.
- Attackers can abuse the runner's resources for malicious purposes.
The vulnerability has a high severity CVSS score of 8.2 due to its network-based attack vector, low complexity, no required privileges, and high impact on confidentiality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the GitHub Actions workflow files in the CoreShop repository, specifically the `.github/workflows/static.yml` file or other workflow files that use the `pull_request_target` trigger.
Look for workflows that use `pull_request_target` and check if they dangerously check out unverified code from the pull request head reference (`ref: ${{ github.event.pull_request.head.ref }}`) and execute scripts from this untrusted code.
To detect if your repository is vulnerable, you can run commands to search for the usage of `pull_request_target` and the checkout of untrusted pull request code in your workflow files.
- grep -r 'pull_request_target' .github/workflows/
- grep -r 'github.event.pull_request.head.ref' .github/workflows/
If these patterns are found, it indicates the workflow may be vulnerable to this Remote Code Execution issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves avoiding the execution of untrusted code in workflows triggered by `pull_request_target`.
Specifically, do not check out and run scripts from the pull request head ref in workflows triggered by `pull_request_target`, as this runs with elevated permissions and access to secrets.
Instead, adopt a separated workflow architecture:
- Use the `pull_request` event to run builds and tests in an unprivileged sandbox environment without access to secrets.
- Upload build artifacts from the `pull_request` workflow.
- Use the `workflow_run` event to trigger a privileged workflow that downloads the artifacts and performs actions requiring secrets.
Currently, no patched versions of CoreShop are available, so applying this workflow change is the recommended immediate step.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to achieve Remote Code Execution on the GitHub Actions runner by submitting malicious pull requests, which can lead to exfiltration of sensitive secrets such as PIMCORE_SECRET or PIMCORE_PRODUCT_KEY.
This exposure of sensitive information and unauthorized code execution can compromise confidentiality and integrity of data, potentially violating compliance requirements under standards like GDPR and HIPAA that mandate protection of sensitive data and secure processing environments.
Because the vulnerability enables attackers to access secrets and possibly modify repository contents or abuse runner resources, it poses a significant risk to maintaining compliance with regulations that require strict access controls and data protection.