{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14316","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-30T09:03:09Z","dateUpdated":"2026-10-29T21:48:33Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This legitimate repository was targeted in a September 2026 campaign that planted shell command injection payloads in GitHub issues, pull requests or comments. When a CI workflow handles that text unsafely, the payload runs inside the job and sends its environment variables, which can include repository tokens, cloud credentials and deployment secrets, to an attacker-controlled server.\n\nMalicious payload found in: unknown (not stated in source; a GitHub issue, pull request or comment)\n\n- Trigger: a GitHub Actions workflow that inserts attacker-controlled GitHub text into shell source. Bash performs command substitution on `$(...)` even inside double quotes, so the text runs as code.\n- Behavior: `env` collects the job's environment variables, `base64 | tr -d '\\n'` encodes them, and `curl -s ... -d` POSTs them over plain HTTP (port 8443) to the collection server. The unique ID in the `/c/` path identifies the target.\n- Impact depends on the job's permissions and secrets. The source did not establish that credentials were obtained or that code was modified.\n","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/306c04cc-9f2a-4fb9-9e1f-919a9e39ed64","name":"Malicious repository: https://github.com/Homebrew/homebrew-cask","tags":["advisory"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"","collectionURL":"","packageName":"","repo":"https://github.com/Homebrew/homebrew-cask","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}