CVE-2026-76826 Details
Description
tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.
A vulnerability exists in the tsParticles library, specifically in versions 4.0.0 to 4.3.2, where the stable publish workflow improperly handles contributor-controlled release notes. The workflow interpolates release note text directly into a Bash command, allowing the execution of shell metacharacters. This issue arises because the release notes are processed before being written to a file, enabling the execution of arbitrary commands when a maintainer initiates a stable release. Such exploitation could alter generated release artifacts or workspace scripts, potentially impacting subsequent release steps that involve the GITHUB_TOKEN and write permissions.
Users are advised to update to tsParticles version 4.3.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896 | [email protected] | Source CodeVendor |
| https://github.com/tsparticles/tsparticles/pull/5888 | [email protected] | Issue TrackingVendor |
| https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tsParticles | >= 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |