Classroom50: Arbitrary file overwrite via symlink in student repository
Summary
Classroom50 before version 1.11.0 writes autograde artifacts (result.json and results.json) into a cloned student repository using the gh teacher download command. If a student commits one of these files as a symlink, hardlink or FIFO, the write can be redirected to an arbitrary path on the teacher's machine, such as shell startup files, SSH keys or git hooks that are executed later. The attacker controls the written content, and the resulting code execution runs with the teacher's GitHub token, which has organization-admin scope. Exploitation requires an enrolled student whose repository the teacher downloads and a teacher who runs the command.
Affected
- Classroom50 (gh-teacher) versions before 1.11.0
- Package: github.com/foundation50/gh-teacher
Fixed in
- Version 1.11.0 (cli-v1.11.0) and later
Workaround
- Do not run gh teacher download against untrusted student repositories.
- If it must be run, use a disposable container or VM without access to sensitive host files or credentials.
- Inspect cloned trees for symlinked, hardlinked or special result.json and results.json entries before the artifact-refresh step runs.
- Reduce the scope of the teacher's GitHub token where possible.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No confirmed public proof of concept.
Our recommendation
- Check whether Classroom50 or gh teacher download is used and which version is installed.
- Upgrade to version 1.11.0 or later.
- Until the upgrade is done, run the tool only in an isolated container or VM with a limited token, and not on untrusted student repositories.
- Review teacher GitHub tokens and remove unneeded scopes such as admin:org.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qx2g-vpwq-466c github.com
- Fix commit 79112f33932d1b5c398a8801d97a8813d52d55ce github.com
- OSV record CVE-2026-94620 osv.dev
- OpenCVE CVE-2026-94620 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:17.
Original description (NVD)
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.