CVE-2026-76826

Name of the Vulnerable Software and Affected Versions tsParticles versions 4.0.0 through 4.3.1

Description The stable publish workflow interpolates steps.release.outputs.body directly into a Bash echo command before writing the RAW RELEASE.md file. This allows shell metacharacters controlled by a contributor in the release-note text to execute when a maintainer initiates a stable release. Such execution can lead to the modification of workspace scripts or generated artifacts, potentially impacting subsequent release steps that possess write permissions and the GITHUB TOKEN.

Recommendations Update to version 4.3.2.