{"id":"CVE-2026-47690","summary":"MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow","details":"MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.","aliases":["GHSA-wrpf-f35c-j28w"],"modified":"2026-07-25T03:56:31.348774892Z","published":"2026-07-21T20:46:26.449Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"923820de8f64d753951fbbd54f7282a3d5f75173"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-1336","CWE-77"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47690.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47690.json"},{"type":"ADVISORY","url":"https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47690"},{"type":"FIX","url":"https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173"},{"type":"FIX","url":"https://github.com/meltano/hub/pull/2247"},{"type":"FIX","url":"https://github.com/meltano/hub/pull/2249"},{"type":"FIX","url":"https://github.com/meltano/hub/pull/2251"},{"type":"PACKAGE","url":"https://github.com/myogahunter/meltano-hub-poc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/meltano/hub","events":[{"introduced":"0"},{"fixed":"923820de8f64d753951fbbd54f7282a3d5f75173"}],"database_specific":{"source":"REFERENCES"}}],"versions":["old-hub"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47690.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}