Back to overview

CVE-2026-47690

HIGH
7.5
CVSS 3.1
Description
MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

Metadata

CVE ID
CVE-2026-47690
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-19 21:18 UTC
Published
2026-07-21 20:46 UTC
Last updated
2026-07-22 14:59 UTC
Primary CWE
CWE-77
CWE-77: Improper Neutralization of Special Elements used in …
Vendor / Product
meltano / hub
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
meltano hub — < 923820de8f64d753951fbbd54f7282a3d5f75173
Weakness (CWE)
CWESourceDescription
CWE-1336 cna CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-77 cna CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References (6)
Back to overview