CVE-2026-44359

{
  "id": "CVE-2026-44359",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T00:16:58.210",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target  and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: \"NONE\" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue."
    },
    {
      "lang": "es",
      "value": "Meshtastic es una solución de red mallada de código abierto. Antes de la versión 2.7.21.1370b23, el flujo de trabajo main_matrix.yml del repositorio de GitHub de Meshtastic se activaba mediante pull_request_target y múltiples trabajos extraían el código del fork del atacante y lo ejecutaban con acceso a los secretos del repositorio y permisos elevados de GITHUB_TOKEN. No existía una puerta de aprobación. Las solicitudes de extracción de usuarios externos con author_association: ’NONE’ activaban automáticamente el flujo de trabajo de CI. El flujo de trabajo ejecutaba directamente archivos controlados por el atacante desde la extracción del fork. Este problema podría haber resultado en un compromiso de la cadena de suministro, un compromiso del runner autoalojado y/o una toma de control del repositorio. Este problema es independiente de GHSA-6mwm-v2vv-pp96, que abordó una inyección de comandos a través de github.head_ref en el trabajo de configuración del mismo flujo de trabajo. Esa corrección se movió correctamente a variables de entorno. Sin embargo, la vulnerabilidad más crítica de extracción del fork en los trabajos de check, build y build-debian-src no fue abordada. La versión 2.7.21.1370b23 contiene un parche para este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "meshtastic",
          "product": "firmware",
          "versions": [
            {
              "version": "< 2.7.21.1370b23",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T00:00:00+00:00",
          "id": "CVE-2026-44359",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=sharing",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede4a78a5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736",
      "source": "[email protected]"
    }
  ]
}