CVE-2026-22869

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-22869
Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pull_request_target trigger combined with checkout of untrusted PR code. An attacker can exploit this to steal credentials, post comments, push code, or create releases.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eigent-ai/eigent/commit/bf02500bbbab0f01cd0ed8e6dc21fe5683d6bfb5 Patch
https://github.com/eigent-ai/eigent/pull/836 Exploit Issue Tracking Third Party Advisory
https://github.com/eigent-ai/eigent/pull/837 Exploit Issue Tracking Patch
https://github.com/eigent-ai/eigent/security/advisories/GHSA-gvh4-93cq-5xxp Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eigent:eigent:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:20

Type Values Removed Values Added
Summary
  • (es) Eigent es una fuerza de trabajo multiagente. Una vulnerabilidad de seguridad crítica en el flujo de trabajo de CI (.github/workflows/ci.yml) permite la ejecución de código arbitrario desde solicitudes de extracción de bifurcación con permisos de escritura en el repositorio. El flujo de trabajo vulnerable utiliza el disparador pull_request_target combinado con la extracción de código de PR no confiable. Un atacante puede explotar esto para robar credenciales, publicar comentarios, enviar código o crear lanzamientos.
References () https://github.com/eigent-ai/eigent/pull/836 - Issue Tracking, Exploit, Third Party Advisory () https://github.com/eigent-ai/eigent/pull/836 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/eigent-ai/eigent/pull/837 - Issue Tracking, Exploit, Patch () https://github.com/eigent-ai/eigent/pull/837 - Exploit, Issue Tracking, Patch

29 Jan 2026, 17:52

Type Values Removed Values Added
CPE cpe:2.3:a:eigent:eigent:*:*:*:*:*:*:*:*
First Time Eigent
Eigent eigent
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References () https://github.com/eigent-ai/eigent/commit/bf02500bbbab0f01cd0ed8e6dc21fe5683d6bfb5 - () https://github.com/eigent-ai/eigent/commit/bf02500bbbab0f01cd0ed8e6dc21fe5683d6bfb5 - Patch
References () https://github.com/eigent-ai/eigent/pull/836 - () https://github.com/eigent-ai/eigent/pull/836 - Issue Tracking, Exploit, Third Party Advisory
References () https://github.com/eigent-ai/eigent/pull/837 - () https://github.com/eigent-ai/eigent/pull/837 - Issue Tracking, Exploit, Patch
References () https://github.com/eigent-ai/eigent/security/advisories/GHSA-gvh4-93cq-5xxp - () https://github.com/eigent-ai/eigent/security/advisories/GHSA-gvh4-93cq-5xxp - Exploit, Third Party Advisory

13 Jan 2026, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-13 21:15

Updated : 2026-06-17 10:20

NVD link : CVE-2026-22869

Mitre link : CVE-2026-22869

CVE.ORG link : CVE-2026-22869

JSON object : View

Products Affected

eigent

  • eigent
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')