A vulnerability described as critical has been identified in OWASP-BLT BLT up to 2.1.1. Affected by this issue is the function pull_request_target of the file github/workflows/pre-commit-fix.yaml. The manipulation results in code injection. This vulnerability is reported as CVE-2026-42603. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.
| Vendor | Product | Versions |
|---|---|---|
| owasp-blt | blt | < 2.1.2, 2.1.1 |
Updated severity to CRITICAL, added affected version 2.1.1, and noted that no exploit exists.
Initial creation
