Log in Start free

Vulnerability · Published Jul 21, 2026 · Assigned by GitHub_M

CVE-2026-47690MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

High 7.5

In plain English

A high-severity command injection in hub from meltano. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 55.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

Affected products (as reported)

VendorProductVersions
meltano hub < 923820de8f64d753951fbbd54f7282a3d5f75173

Weakness: CWE-77, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References