CVE-2026-47174 Details
Description
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker can make a pull request build satisfy the deploy workflow’s main branch condition, the deploy job checks out the triggering workflow commit, builds it into a Docker image, pushes it as latest, and triggers Dokploy deployment. This can allow attacker-controlled pull request code to become the deployed production site image without being merged. This issue has been patched in version 1.0.1.
A vulnerability in Duck Site versions prior to 1.0.1 allows untrusted pull request code to be deployed to production. The issue arises because the repository's deploy workflow, which has package-write permissions and access to deployment secrets, can be triggered by a pull request that meets certain conditions. An attacker can manipulate a pull request to satisfy the deploy workflow's main branch requirement, causing the deployment of code that has not been reviewed or merged. This vulnerability could lead to unauthorized changes on the production site, such as defacing the website, injecting malicious JavaScript, or compromising release artifacts.
Users are advised to update Duck Site to version 1.0.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 11, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/duck-organization/duck-site/security/advisories/GHSA-qj93-7xrg-rvhw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/duck-organization/duck-site/security/advisories/GHSA-qj93-7xrg-rvhw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Duck Site | 1.0.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | CVE Modified | CISA-ADP |
| Jun 11, 2026 | New CVE Received | [email protected] |