Cyber Posture

CVE-2026-34243

CriticalPublic PoC

Published: 31 March 2026

Published
31 March 2026
Modified
03 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 20.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2026-34243 is a command injection vulnerability (CWE-77, CWE-78) in the wenxian tool, which generates BIBTEX files from identifiers such as DOI, PMID, arXiv ID, or paper title. It affects versions 0.3.1 and prior, specifically within a GitHub Actions workflow that incorporates untrusted user input from issue_comment.body directly into a shell command. This flaw enables potential arbitrary code execution on the GitHub Actions runner, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Any unauthenticated attacker with network access can exploit this vulnerability by posting a specially crafted comment on a GitHub issue in the repository, as it requires no privileges or user interaction beyond low-complexity payload construction. Successful exploitation grants arbitrary code execution on the runner environment, potentially compromising the confidentiality, integrity, and availability of the runner's resources.

The GitHub security advisory (GHSA-r4fj-r33x-8v88) notes that, at the time of publication on 2026-03-31, no publicly available patches exist for this issue.

Details

CWE(s)
CWE-77CWE-78

Affected Products

njzjz
wenxian
≤ 0.3.1

MITRE ATT&CK Enterprise Techniques

T1677 Poisoned Pipeline Execution Execution
Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection in GitHub Actions workflow via unauthenticated issue comments enables poisoned pipeline execution (T1677), exploitation of public-facing application (T1190), and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References