{"id":"CVE-2026-76826","published":"2026-11-04T23:17:58.400","lastModified":"2026-11-04T23:17:58.400","description":"tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896","tags":[]},{"url":"https://github.com/tsparticles/tsparticles/pull/5888","tags":[]},{"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx","tags":[]}],"exploitRefs":[{"url":"https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896","tags":[]},{"url":"https://github.com/tsparticles/tsparticles/pull/5888","tags":[]},{"url":"https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx","tags":[]}],"hasPoc":true,"ai":null}