Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55675— Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

Quick assessment

Affected
saltyorg docs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Salty 文档仓库负责构建和部署 docs.saltbox.dev 网站。在提交 649c9aea2daef1168eeb0415b44e65dbbde9f220 之前， 会将不受信任的分支（fork）提交记录到 工件中；随后， 中携带密钥的 作业会在执行 之前检出该提交。因此，来自分支的拉取请求（Pull Request）可以提供攻击者编写的 或 PEP 517 构建钩子，这些代码将在拥有特权的基仓库工作流中执行，该工作流持有 、 、 以及具备写入权限的 。这可能导致秘密泄露并引发后续的系统被接管。该漏洞并非由

CVSS 10.0 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
saltyorg docs < 649c9aea2daef1168eeb0415b44e65dbbde9f220 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55675

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
Source: CVE Program / CVE List V5
Vulnerability Description
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
saltyorg docs < 649c9aea2daef1168eeb0415b44e65dbbde9f220 -

II. Public POCs for CVE-2026-55675

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55675

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55675 (1)

IV. Related Vulnerabilities

Same product: docs
Same weakness: CWE-94

V. Comments for CVE-2026-55675

No comments yet

Leave a comment