漏洞关键信息 漏洞概述 漏洞类型: Command injection Severity: Moderate CVE ID: CVE-2026-26323 Weaknesses: CWE-78 影响范围 Affected versions: >=2026.1.8 <2026.2.14 Patched versions: 2026.2.14 影响描述 Summary: Command injection in the maintainer/dev script . Impact: Affects contributors/maintainers (or CI) who run in a source checkout that contains a malicious commit author email (e.g. crafted values). Normal CLI usage is not affected ( ). 原因分析 Details: The script derived a GitHub login from author metadata and interpolated it into a shell command (via ). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run. 解决方案 Fix commit: a429380e337152746031d290432a4b93aa553d55 Planned patched version: 2026.2.14 报告者 Credits: @scanleale and @MegaManSec of AISLE Research Team