jellyfin code-quality.yml vulnerabilities

Latest jellyfin code-quality.yml CVEs

Newest publication first

1. CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

   Published 2026-03-11

   Critical·CVSS 9.8 EPSS 0.52%

   Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vul...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.