Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44359: Meshtastic firmware runs untrusted code from pull requests

CVE-2026-44359 · published 3 months ago

Summary

The automatic build process for Meshtastic firmware could download and run code from a stranger's fork when a pull request was opened, giving the attacker access to secret keys and high‑level permissions. This could let an attacker take control of the repository or the machines used for building the software. Update to version 2.7.21.1370b23 or later to stop the unsafe behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	meshtastic	firmware	< 2.7.21.1370b23
Ubuntu:26.04:LTS	canonical	meshtastic	All versions

Original advisory text

Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" triggered the CI workflow automatically. The workflow directly executes attacker-controlled files from the fork checkout. This issue could have resulted in supply chain compromise, self-hosted runner compromise, and/or repository takeover for the repo. This issue is separate from GHSA-6mwm-v2vv-pp96, which addressed a command injection via github.head_ref in the setup job of the same workflow. That fix correctly moved to environment variables. However, the more critical fork checkout vulnerability across the check, build, and build-debian-src jobs was not addressed. Version 2.7.21.1370b23 contains a patch for thie issue.

References

https://drive.google.com/file/d/1GdHT2s5hMYCiHt4zrWt1q58mvL7WQC0M/view?usp=shari... URL
https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96 Vendor Advisory
https://ubuntu.com/security/CVE-2026-44359 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-44359 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44359... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-44359 Vendor Advisory
https://github.com/meshtastic/firmware/commit/5716aeba3bc1e1d34fba9567ff88917ede... Patch
https://github.com/meshtastic/firmware/security/advisories/GHSA-mjx5-98jq-q736 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

10.0 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-94Code Injection

CWE-829Inclusion of Functionality from Untrusted Control Sphere

Timeline

Published19 Jul 2026

Updated3 Nov 2026

First seen20 Jul 2026

Sources

CVE-2026-44359 · NVD

CVE-2026-44359 · MITRE

UBUNTU-CVE-2026-44359 · OSV

CVE-2026-44359 · OSV

Track software like this

Free during beta