conflibot Command Injection via PR Branch Names Enables GitHub Token Theft (CVE-2026-55158)

A GitHub Security Advisory (GHSA-2qvg-qr73-mqxp) discloses a command injection vulnerability in wktk/conflibot, tracked as CVE-2026-55158 with a CVSS score of 9.1 and a public proof-of-concept.

What Happened

According to the advisory, versions of conflibot prior to 1.2.1 build git commands via string interpolation and execute them through a shell. One of the interpolated values is the pull request's head branch name (head.ref), which is attacker-controlled — anyone opening a pull request, including from a fork, can set a branch name containing shell metacharacters (` , $( ), ;, |, &).

The documented conflibot workflow runs on the pull_request_target event, which grants the job access to the base repository's secrets and a write-scoped GITHUB_TOKEN. Per the advisory, a crafted branch name results in arbitrary command execution on the runner in that context — no maintainer interaction or special privileges are required; the action fires automatically when the PR is opened.

Why It Matters

This is a supply-chain-adjacent CI/CD risk: any repository using conflibot below v1.2.1 with the recommended pull_request_target configuration is exposed to secret exfiltration, write-token abuse, and unauthorized pushes to the repository — triggered purely by an external, unauthenticated contributor opening a PR. The advisory notes there is no configuration-only workaround; affected repos must upgrade the action itself.

What Defenders Should Do Now

• Inventory workflows for any use of wktk/conflibot, especially under pull_request_target, and upgrade to 1.2.1 or 2.0.0, where all git invocations use argument arrays (execFile/spawn) instead of a shell, and PRs are referenced by number via refs/pull/<n>/head rather than by branch name.
• Note the self-hosted runner requirements for v2.0.0: Node.js 24 and git 2.38+.
• More broadly, audit other pull_request_target workflows for shell interpolation of attacker-controlled PR metadata (branch names, titles, labels) — this is a recurring GitHub Actions anti-pattern, not unique to this action.
• Review GitHub Actions audit logs for unexpected pushes, secret access, or workflow runs triggered by PRs from unfamiliar forks around the time an outdated conflibot version was in use.

This is a same-day advisory and the details above reflect what has been disclosed so far; treat this as developing intel and monitor for updates. See the original advisory for full technical detail and patch commits: GHSA-2qvg-qr73-mqxp.