Understanding and Defending Against Command Injection in conflibot via Crafted Pull Request Branch Names
This educational analysis covers a critical vulnerability in conflibot, a GitHub action, that allows for command injection via crafted pull request branch names. The vulnerability, tracked as CVE-2026-55158, affects versions before 1.2.1 and has a CVSS score of 9.1. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection strategies, and defensive measures.