{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14528","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-04T09:01:30Z","dateUpdated":"2026-11-04T03:17:10Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a credential stealer disguised as a font file and a hidden VS Code task that runs it when the folder is opened. Anyone who opened the project in VS Code with automatic tasks allowed after October 19, 2026 should treat that machine's credentials as compromised, because the stealer also installs a scheduled job that runs commands from the attacker's server every five minutes.","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/b8f97076-e4cd-4248-9b7b-5c4720adc0ee","name":"Malicious repository: https://github.com/cyuberpunk/greenlight","tags":["advisory"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"","collectionURL":"","packageName":"","repo":"https://github.com/cyuberpunk/greenlight","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}