CVE-2026-55158

Conflibot, a GitHub Action that warns about merge conflicts in other open pull requests, builds git checkout/merge/format-patch commands by interpolating the attacker-controlled head.ref branch name into strings passed to exec, allowing shell command injection. Because the documented configuration runs on the pull_request_target trigger, any attacker can open a pull request (including from a fork) whose branch name contains shell metacharacters, and the injected commands execute automatically without any maintainer interaction. The code runs on the CI runner with access to base-repository secrets and a write-scoped GITHUB_TOKEN, enabling arbitrary command execution, secret/token exfiltration, and unauthorized pushes to the repository. Repositories using Conflibot versions prior to 1.2.1 (and any pre-2.0.0 v2 releases) are affected; the flaw is fixed in 1.2.1 and 2.0.0, which use execFile/spawn argument arrays and numeric pull-request refs. There is no known public proof of concept and no evidence of in-the-wild exploitation.

What to do: Upgrade the Action reference to v1.2.1 (or the v2.0.0+ line) and pin it to a commit SHA rather than a mutable branch. Audit past workflow runs for suspicious commands or unrecognized git activity around Conflibot steps, and rotate any secrets reachable from the runner plus the GITHUB_TOKEN if malicious runs are found. Review whether pull_request_target is required at all, since it grants fork-originated code paths access to base-repository secrets.