CVE-2026-55675 Details
Description
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
A vulnerability exists in the Salty documentation repository's GitHub Actions workflows, allowing for unauthorized access to sensitive secrets. This issue arises from the 'trigger-pr-build.yml' workflow, which records an untrusted fork commit and the 'build-pr.yml' workflow, which installs dependencies from that commit using pip. An attacker can exploit this by injecting malicious code into the installation process, executing it in a privileged context with access to secret tokens. The vulnerability has been fixed by restructuring the workflows to prevent such exploitation.
The vulnerability has been fixed by updating the 'build-pr.yml' workflow to remove the secret-exposing 'pip install' command and instead, only deploy the pre-built static site artifact. Additionally, the 'secrets.MKDOCS_GIT_COMMITTERS_APIKEY' was removed from both the 'build-pr.yml' and 'build.yml' workflows.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/saltyorg/docs/commit/649c9aea2daef1168eeb0415b44e65dbbde9f220 | [email protected] | Source CodeVendor |
| https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1357 | Reliance on Insufficiently Trustworthy Component | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| saltyorg/docs | <= d1ee8f2f90ad0143138cc69edf85679780e3154e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |