conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target
GitHub Actions wktk/conflibot · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-55158 · GHSA-2qvg-qr73-mqxp · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
GitHub Actions wktk/conflibot · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2026-55158 · GHSA-2qvg-qr73-mqxp · amended
npm deepmerge-ts · Upgrade to 8.0.0 or later · < 8.0.0 · CVE-2026-40345 · GHSA-ggr8-5vv4-36mx
crates.io quinn-proto · Upgrade to 0.11.17 or later · >= 0.11.15, < 0.11.17 · GHSA-qfwj-vfxf-92j2
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.