Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-55576MaaAssistantArknights: PR-title expression injection in release-preparation.yml

High 8.8

In plain English

A high-severity OS command injection in MaaAssistantArknights from MaaAssistantArknights. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull_request.title into a run: shell command during the pull_request opened, reopened, and ready_for_review events, so a non-draft fork PR whose title starts with Release v could execute shell commands on the ubuntu-latest runner during the generate-changelog job. This vulnerability is fixed by commit cafc3946059e6337d2089d4fec8b6885ba17c332.

Affected products (as reported)

Vendor	Product	Versions
MaaAssistantArknights	MaaAssistantArknights	< cafc3946059e6337d2089d4fec8b6885ba17c332

Weakness: CWE-78, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/MaaAssistantArknights/MaaAssistantArknights/security/advisories/GHSA-pqx2-5g66-f5w8 x_refsource_CONFIRM
https://github.com/MaaAssistantArknights/MaaAssistantArknights/commit/cafc3946059e6337d2089d4fec8b6885ba17c332 x_refsource_MISC