Format-String Vulnerability in Otterdog Web Application by Eclipse

CVE-2026-123870

What is CVE-2026-123870?

The Otterdog web application contains a vulnerability that arises when the GITHUB_WEBHOOK_SECRET configuration is left unset or empty. This flaw permits an unauthenticated network client to manipulate the incoming GitHub webhook JSON body, leading to a scenario where the application evaluates untrusted inputs using Python's eval() function. Consequently, this allows attackers to execute arbitrary Python code on the host, significantly compromising the security of the web application. Proper configuration of the GITHUB_WEBHOOK_SECRET is crucial to prevent unauthorized access and safeguard against malicious exploits.

References