Vowpal Wabbit
Approved changes feed: RSS · Atom
cpe:2.3:a:vowpalwabbit:vowpal_wabbit:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Vowpalwabbit (ca7e3342-bd1d-5e5e-be97-ae68c1d3d013) |
|---|---|
| Product | Vowpal Wabbit (1911f96b-75c1-5cba-b939-5db9de079833) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/vowpalwabbit/vowpal_wabbit |
purl2cpe | 2026-06-01 10:11:46.941393 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44723 |
vulnerable | 2026-06-08 08:05:11.290401 |
Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner
MEDIUM (5)
Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run_tests_model_gen_and_load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull_request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit.
Published: 2026-05-26T15:49:17.951Z
Updated: 2026-05-28T13:58:23.038Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.