openlit software development kit vulnerabilities

Latest openlit software development kit CVEs

Newest publication first

1. CVE-2026-27941 OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

   Published 2026-02-26

   Critical·CVSS 10.0 EPSS 0.45%

   OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the pull_request_target event while checking out and executing untrusted code from forked pull requests. These workflows run with th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.