Remote Code Execution Vulnerability in OWASP BLT by OWASP
CVE-2026-40316

8.8HIGH

Key Information:

Vendor

Owasp-blt

Status
Blt
Vendor
CVE Published:
15 April 2026

What is CVE-2026-40316?

The OWASP BLT platform, which supports quality assurance testing and vulnerability disclosures, has a critical vulnerability that allows for remote code execution in versions prior to 2.1.1. This security flaw resides in the .github/workflows/regenerate-migrations.yml workflow, where the pull_request_target trigger is misconfigured. It runs with elevated GITHUB_TOKEN permissions, enabling an attacker to manipulate the CI environment. Specifically, if an external contributor submits a pull request and a maintainer applies the regenerate-migrations label, the process can inadvertently execute malicious Python code from attacker-controlled files. This can lead to severe consequences including the exfiltration of confidential data and potential supply chain attacks. A fix addressing this flaw is anticipated in version 2.1.1.

Affected Version(s)

BLT <= 2.1

References

https://github.com/OWASP-BLT/BLT/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.