How severe is CVE-2026-55158?

CVE-2026-55158 has a CVSS score of 9.1/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-55158?

CVE-2026-55158 affects the following packages: wktk/conflibot (GitHub Actions). Ecosystems affected: GitHub Actions.

How do I fix CVE-2026-55158?

Update wktk/conflibot to 1.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55158 is resolved across your whole dependency graph.

How do I detect CVE-2026-55158 in my GitHub Actions dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wktk/conflibot, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-55158 if there is no patch (or I can't update yet)?

Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Is CVE-2026-55158 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-55158 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-55158?

CVE-2026-55158 has an EPSS (Exploit Prediction Scoring System) score of 0.8%, placing it in the 55th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-55158?

CVE-2026-55158 is classified as OS Command Injection (CWE-78). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was CVE-2026-55158 published, and has it been updated?

CVE-2026-55158 was published on September 15, 2026 and was last updated on October 1, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 GitHub Actions

Not in CISA KEV

CRITICAL severity

CVE-2026-55158 — wktk/conflibot

CRITICALFix: wktk/conflibot@0107ac6

CVE-2026-55158 is a critical-severity (CVSS 9.1) OS Command Injection vulnerability in wktk/conflibot. A fix is available for wktk/conflibot — see the affected versions and patch details below.

Conflibot: Command injection via crafted pull request branch names under pull_request_target

Also known asGHSA-2qvg-qr73-mqxp

Published

Sep 15, 2026

Updated

Oct 1, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
A successful exploit gives an attacker total control of the affected component, not partial access.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55158.

EPSS Exploitation Probability

via FIRST.org ↗

0.8%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs55th percentile — riskier than 55% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-55158 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 382,205 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected

📦wktk/conflibot

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects GitHub Actions packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (head.ref), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `, $( ), ;, |, or &.

The recommended workflow runs conflibot on the pull_request_target event, where the job has access to the base repository's secrets and a write-scoped GITHUB_TOKEN. As a result, a crafted branch name causes arbitrary command execution on the runner with that write token in the environment, allowing an attacker to exfiltrate secrets and the token, push to the repository, or otherwise abuse the token's permissions. No special privileges and no maintainer interaction are required — the action runs automatically when the pull request is opened.

Affected configurations

Any workflow using wktk/conflibot at a version earlier than 1.2.1. The risk is highest under pull_request_target (the documented configuration), because that is where the write token and secrets are exposed to attacker-influenced refs.

Patches

Fixed in 1.2.1 and 2.0.0. All git invocations now use argument arrays via execFile/spawn instead of a shell, so branch names can no longer be interpreted as shell syntax, and pull requests are referenced by number through refs/pull/<n>/head rather than by branch name.

Workarounds

There is no configuration-only workaround for affected versions. Upgrade to wktk/conflibot@v2. On GitHub-hosted runners this is a drop-in upgrade; self-hosted runners additionally need Node.js 24 support and git 2.38 or later.

Resources

Fix (v2.0.0): https://github.com/wktk/conflibot/commit/0107ac6
Fix (v1.2.1): https://github.com/wktk/conflibot/commit/59e255c
Releases: https://github.com/wktk/conflibot/releases/tag/v2.0.0 and https://github.com/wktk/conflibot/releases/tag/v1.2.1

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦GitHub Actions	`wktk/conflibot`	all versions	1.2.1

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wktk/conflibot, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update wktk/conflibot to 1.2.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55158 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

Frequently Asked Questions

### Impact Versions of conflibot before `1.2.1` build `git` commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names (`head.ref`), which are attacker-controlled: anyone can open a pull request (including from a fork) whose head branch name contains shell metacharacters such as `` ` ``, `$( )`, `;`, `|`, or `&`. The recommended workflow runs conflibot on the `pull_request_target` event, where the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. As a result, a crafted branch name causes arb