PT-2026-145304
CVE-2026-65820
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
aeon versions prior to 1.5.0
Description
A GitHub Actions workflow used
pull request target for pre-commit checks on pull requests from forks. This configuration allowed code controlled by a fork to be checked out and executed within a privileged context. The workflow generated and used elevated credentials and could automatically commit or push fixes back to pull request branches, creating a risk of token exposure and providing a write path to the repository if a malicious fork pull request was submitted.Recommendations
Update aeon to version 1.5.0.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾