The vulnerable path crossed the CI trust boundary between a contributor fork and a workflow identity with more capabilities than the contributor should hold. AI code review or generation does not independently authorize running the proposed repository content with credential access. The vendor summary does not disclose the exact GitHub event, checkout step…
Inspect the ClaimsCase · DiggingBeagle record
Junie GitHub Action ran fork-controlled code under workflow credentials
The AI coding action could give untrusted fork content a privileged CI execution path.
Public disclosure: Nov 6, 2026
Scope
JetBrains Junie GitHub Action versions earlier than 1.8.0 when processing fork-controlled material.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The authoritative vulnerability advisory identifies fork-origin code execution and affected versions, but omits the precise workflow sequence and any in-the-wild case. An impact band remains unassigned because the available evidence does not establish a comparable severity score or verified numerical loss for this assessment.
Assessed Nov 8, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-JUNIE-ACTION-FORK-PRIVILEGE-01 · Junie GitHub Action fork-code execution advisory
At a glance
Separating untrusted contribution data from privileged automation matters even when the intermediary is an AI agent.
Read the implicationsThe vendor summary does not disclose the exact GitHub event, checkout step or a publicly observed exploit. It must not be relabeled as a proven pull_request_target incident without execution details.
Limits and uncertaintyFull account
The vulnerable path crossed the CI trust boundary between a contributor fork and a workflow identity with more capabilities than the contributor should hold. AI code review or generation does not independently authorize running the proposed repository content with credential access.
The vendor summary does not disclose the exact GitHub event, checkout step or a publicly observed exploit. It must not be relabeled as a proven pull_request_target incident without execution details.
The input was attacker-controlled repository content, while the effective authority belonged to the CI workflow. The advisory establishes the risk of executing fork-derived code with those credentials before version 1.8.0, but does not publish enough workflow detail to name the exact trigger or checkout sequence. That uncertainty matters: this is separate from Junie's HTML-entity prompt-filter bypass and cannot automatically be called a pull_request_target exploit. Pinning the fixed action does not replace reviewing the workflow's token and secret privileges.
Mechanism and trust boundary
- 01
A fork contributor supplies content consumed by the action.
- 02
The workflow executes that content with its own credential context.
- 03
The contributor-controlled code can act with workflow authority.
Claims & evidence
CLM-JUNIE-ACTION-FORK-PRIVILEGE-01GitHub Advisory CVE-2026-123852 states that a Junie GitHub Action before 1.8.0 could execute code originating in fork-controlled updates with the credentials of its workflow.supported
Basis: reported finding
- supportsJunie GitHub Action fork-code execution advisoryprimary disclosure
CVE-2026-123852 description; affected and patched versions
Implications
Separating untrusted contribution data from privileged automation matters even when the intermediary is an AI agent.
Controls and mitigations
- Use Junie GitHub Action 1.8.0 or a later fixed version and inspect checkout and execution steps that read fork-controlled contributions.
- Run untrusted code without elevated workflow credentials or secrets; do not infer the exact vulnerable GitHub trigger without vendor evidence.
Unknowns and contradictions
- The vendor summary does not disclose the exact GitHub event, checkout step or a publicly observed exploit. It must not be relabeled as a proven pull_request_target incident without execution details.
Sources and citation
Material revision history
- Nov 8, 2026 · Canonical change recorded · new in release · revision 229