Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-44359

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

View on NVD

Analysis

Meshtastic fue vulnerable a la ejecución de código arbitrario mediante flujos de trabajo de GitHub Actions mal configurados que permitían a atacantes externos acceder a secretos del repositorio con permisos elevados. Esta falla permite el compromiso total de la cadena de suministro y el control del repositorio al ejecutar código de forks maliciosos sin aprobación previa. Es un riesgo crítico para la integridad de proyectos de hardware y software que dependen de pipelines de CI/CD automatizados.

Relevant roles

CyberSecurityHardwareCloudBackend

Severity

Score: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: NONE
Weakness (CWE): CWE-94CWE-829

EPSS

Probability of exploitation (next 30 days): 0.0100 (1.0%)
Percentile: 59.1%
EPSS: 2026-07-20

Technical description

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

Published: 7/20/2026, 12:16:58 AM
Last modified: 7/20/2026, 7:17:22 PM

References

HomeEventsBlogResourcesTeam