Evidence · DiggingBeagle record
Junie GitHub Action fork-code execution advisory
CVE-2026-123852: untrusted fork content could execute in a workflow with privileged credentials before 1.8.0.
- Source role
- primary disclosure
Evidence record
CVE-2026-123852: untrusted fork content could execute in a workflow with privileged credentials before 1.8.0.
Claim-level citations (1)
- supportsJunie GitHub Action ran fork-controlled code under workflow credentials: GitHub Advisory CVE-2026-123852 states that a Junie GitHub Action before 1.8.0 could execute code originating in fork-controlled updates with the credentials of its workflow.
CVE-2026-123852 description; affected and patched versions