{"id":15119,"date":"2026-09-04T19:02:26","date_gmt":"2026-09-04T11:02:26","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-44359"},"modified":"2026-09-04T19:02:26","modified_gmt":"2026-09-04T11:02:26","slug":"cve-2026-44359","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-44359","title":{"rendered":"CVE-2026-44359 [CRITICAL] &#8211; Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, th"},"content":{"rendered":"<p>Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository&#8217;s main_matrix.yml workflow is triggered by pull_request_target  and multiple jobs check out the attacker&#8217;s fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: &#8220;NONE&#8221; triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and\/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository&#8217;s main_matrix.yml workflow is triggered by pull_request_target  and multiple jo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15119","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}