Vulnerability details

CVE-2026-47690

meltano hub

MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

CVSS 3.1

7.5High

Official description

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
meltano	hub	< 923820de8f64d753951fbbd54f7282a3d5f75173	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/myogahunter/meltano-hub-poc x_refsource_MISC
https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w x_refsource_CONFIRM
https://github.com/meltano/hub/pull/2247 x_refsource_MISC
https://github.com/meltano/hub/pull/2249 x_refsource_MISC
https://github.com/meltano/hub/pull/2251 x_refsource_MISC
https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-22
Last updated: 2026-07-22
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.52%

Probability of exploitation in 30 days

44.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine