CVE-2026-55675

Name of the Vulnerable Software and Affected Versions Salty documentation repository versions prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220

Description An issue exists where the .github/workflows/trigger-pr-build.yml workflow records an untrusted fork commit in the pr info artifact. Subsequently, the workflow run job in .github/workflows/build-pr.yml checks out this commit and executes pip install -r requirements.txt. An attacker can submit a fork pull request containing a malicious setup.py or PEP 517 build hooks. When installed, this code executes within the privileged base-repository workflow, granting access to sensitive secrets including CF API TOKEN, GH TOKEN, MKDOCS GIT COMMITTERS APIKEY, and a write-capable GITHUB TOKEN, which can lead to secret disclosure and further system compromise.

Recommendations Update the Salty documentation repository to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.