Back to overview

CVE-2026-31852

CRITICAL
10.0
CVSS 3.1
Description
Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple App Store supply chain attack, GitHub Container Registry (ghcr.io) package poisoning, and full jellyfin organization compromise via cross-repository token usage. Note: This is not a code vulnerability, but a vulnerability in the GitHub Actions workflows. No new version is required for this GHSA and end users do not need to take any actions.

Metadata

CVE ID
CVE-2026-31852
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-03-09 19:02 UTC
Published
2026-03-11 17:04 UTC
Last updated
2026-03-11 17:40 UTC
Primary CWE
CWE-269
CWE-269: Improper Privilege Management
Vendor / Product
jellyfin / code-quality.yml
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
jellyfin code-quality.yml — < 109217e75f38394b2f6e46e25dfe5a721203d3c8
Weakness (CWE)
CWESourceDescription
CWE-269 cna CWE-269: Improper Privilege Management
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (2)
Back to overview