Salty docs: Code execution from fork pull requests in CI workflow
Summary
The GitHub Actions deployment pipeline of the Salty documentation repository installs Python dependencies from a checked-out fork pull request in a job that holds deployment secrets. An attacker can supply a malicious setup.py or PEP 517 build hook that runs with access to Cloudflare, GitHub and MkDocs tokens and a write-capable GITHUB_TOKEN. Exploitation requires only opening a pull request from a fork with crafted content; the CVSS score is 10.0.
Affected
- Versions before commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 (saltyorg/docs).
- The vendor advisory lists the affected range as up to commit d1ee8f2f90ad0143138cc69edf85679780e3154e; the sources differ in the boundary.
- Release version numbers: Unknown.
- Saltbox runtime installations: no evidence of impact.
Fixed in
- Commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 (saltyorg/docs).
- Release version: Unknown.
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
- The advisory describes a working proof of concept with secret exfiltration in a mirror repository.
- No evidence of exploitation in the wild found; not listed in CISA KEV according to a third-party page.
Our recommendation
- If you run a fork or copy of this docs pipeline, apply commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
- Review your own GitHub Actions workflows: do not check out and install code from untrusted forks in jobs that have secrets or write tokens.
- Restrict GITHUB_TOKEN permissions, require approval for fork workflow runs, and rotate secrets exposed to such jobs if the pattern was present.
- Low relevance for typical SME environments; no action needed for Saltbox installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 github.com
- GitHub Security Advisory GHSA-wr2h-fpxm-ff4x github.com
- OSV record CVE-2026-55675 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:25.
Original description (NVD)
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.