wktk vulnerabilities

Products

• conflibot 1

Latest wktk CVEs

Newest publication first

1. CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target

   Published 2026-09-15

   Critical·CVSS 9.1 EPSS 0.80%

   Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings pa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.