auto-changelog: Code execution via untrusted in-repository configuration
Summary
auto-changelog before 2.6.1 reads configuration from the repository it processes (the .auto-changelog file or the auto-changelog key in package.json) and trusts security-sensitive options from it. A crafted repository can make the tool require() an attacker-chosen JavaScript file, so running it over untrusted content executes code with the privileges of the invoking user or CI job, including access to workflow secrets. Other options allow git argument injection, writing to arbitrary paths and outbound requests. Exploitation requires that someone runs the tool on attacker-controlled content, for example in CI on untrusted pull requests or locally on a third-party repository.
Affected
- auto-changelog versions before 2.6.1 (CVE record); the GitHub advisory lists <= 2.6.0
Fixed in
- Upgrade to 2.6.1 or later, as stated in the CVE record and the project changelog.
- Note: the GitHub advisory GHSA-xpvr-2hvx-m8q4 lists 2.7.0 as the patched version. Check the advisory before rollout and use the newest available release.
Workaround
- Do not run auto-changelog over repositories you do not control, including CI workflows that check out pull request heads from forks.
- Do not use --unsafe-config for untrusted repositories.
- Pass code-loading and similar options (handlebarsSetup, plugins, template URLs) as command line flags instead of in-repo configuration.
Exploitation
- CISA SSVC: exploitation status 'poc' (proof of concept), not automatable.
- No confirmed exploitation in the wild found.
- A public proof of concept is reported but not independently verified.
Our recommendation
- Find all projects that use auto-changelog (package.json, lockfiles, CI workflows and developer tools).
- Upgrade to 2.6.1 or later, and verify against the GitHub advisory whether 2.7.0 is required.
- Review CI jobs that run auto-changelog on pull requests from forks or external contributors, and do not give such jobs access to secrets.
- Run the tool only on trusted repositories and do not add --unsafe-config for other repositories.
- Expect refusals after upgrading where in-repo configuration sets restricted options; fix those configurations explicitly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xpvr-2hvx-m8q4 github.com
- Fix commit 1d02a48 (treat in-repo config as untrusted) github.com
- OSV entry CVE-2026-12171 osv.dev
- auto-changelog CHANGELOG github.com
- auto-changelog README (Security section) github.com
- NixOS nixpkgs tracker issue 570887 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:51.
Original description (NVD)
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks out an untrusted pull request head, or locally on a forked or third-party repository) executes attacker-chosen code with the privileges of the invoking user or CI job, including access to workflow secrets, without the repository dependencies ever being installed. The plugins option similarly loads attacker-controlled modules from the repository. Under the same conditions, appendGitLog/appendGitTag allow git argument injection (e.g. --output= to write arbitrary files), output allows writing attacker-influenced content to arbitrary paths, and template causes an outbound request to an attacker-chosen URL. Version 2.6.1 treats in-repository configuration as untrusted and refuses to run when it sets these options, unless the new --unsafe-config flag is passed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.