{"id":"CVE-2026-12171","published":"2026-10-05T17:17:14.510","lastModified":"2026-10-06T16:08:43.180","description":"auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks out an untrusted pull request head, or locally on a forked or third-party repository) executes attacker-chosen code with the privileges of the invoking user or CI job, including access to workflow secrets, without the repository dependencies ever being installed. The plugins option similarly loads attacker-controlled modules from the repository. Under the same conditions, appendGitLog/appendGitTag allow git argument injection (e.g. --output= to write arbitrary files), output allows writing attacker-influenced content to arbitrary paths, and template causes an outbound request to an attacker-chosen URL. Version 2.6.1 treats in-repository configuration as untrusted and refuses to run when it sets these options, unless the new --unsafe-config flag is passed.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-22","CWE-88","CWE-94","CWE-829","CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cookpete/auto-changelog/commit/1d02a48a0a57c69a3cd268aca375d64d50877c1a","tags":[]},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","tags":[]},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","tags":[]}],"exploitRefs":[{"url":"https://github.com/cookpete/auto-changelog/commit/1d02a48a0a57c69a3cd268aca375d64d50877c1a","tags":[]},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","tags":[]},{"url":"https://github.com/cookpete/auto-changelog/security/advisories/GHSA-xpvr-2hvx-m8q4","tags":[]}],"hasPoc":true,"ai":{"summary":"The auto-changelog tool allows untrusted repository configuration to execute arbitrary code with the privileges of the running process, enabling remote code execution through attacker-controlled configuration files. This vulnerability is particularly dangerous in CI/CD workflows where untrusted code is checked out and processed.","exploitability":"Exploitation is relatively straightforward when a CI workflow checks out untrusted pull requests or repositories, requiring only that the auto-changelog tool be executed on attacker-controlled content without the --unsafe-config flag.","blast_radius":"The impact could be severe in CI environments where secrets are accessible to the running process, potentially allowing attackers to exfiltrate sensitive data or gain full access to CI infrastructure.","remediation":"Upgrade to version 2.6.1 or later, which treats in-repository configuration as untrusted and refuses to execute with vulnerable options unless --unsafe-config flag is explicitly passed.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","ci-cd","config-injection"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:58:25.102Z"}}