CVE-2026-12171

Name of the Vulnerable Software and Affected Versions auto-changelog versions prior to 2.6.1

Description The software merges configuration from the target repository, specifically from the .auto-changelog file and the auto-changelog key in package.json, into its options and honors security-sensitive settings from these untrusted sources. This allows for remote code execution if the tool is run over attacker-controlled content, such as in CI workflows checking out untrusted pull requests or locally on third-party repositories. Specifically, the handlebarsSetup option is passed to require(), and the plugins option loads modules from the repository, both of which can execute arbitrary code with the privileges of the user or CI job. Additionally, appendGitLog and appendGitTag allow git argument injection, which can be used to write arbitrary files via the --output= flag. The output option allows writing influenced content to arbitrary paths, and the template option can trigger outbound requests to attacker-chosen URLs.

Recommendations Update to version 2.6.1 or later.