CVE-2025-53546

Folo organizes feeds content into one timeline. Using pull_request_target on .github/workflows/auto-fix-lint-format-commit.yml can be exploited by attackers, since untrusted code can be executed having full access to secrets (from the base repo). By exploiting the vulnerability is possible to exfiltrate GITHUB_TOKEN which has high privileges. GITHUB_TOKEN can be used to completely overtake the repo since the token has content write privileges. This vulnerability is fixed in commit 585c6a591440cd39f92374230ac5d65d7dd23d6a.

• CWE-829

• https://github.com/RSSNext/Folo/commit/585c6a591440cd39f92374230ac5d65d7dd23d6a
• https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4
• https://github.com/RSSNext/Folo/security/advisories/GHSA-h87r-5w74-qfm4

Published

Jul 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53540arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…8.7
• CVE-2025-53541Tuleap is an Open Source Suite created to facilitate managem…5.4
• CVE-2025-53542Headlamp is an extensible Kubernetes web UI. A command injec…7.7
• CVE-2025-53543Kestra is an event-driven orchestration platform. The error …4.2
• CVE-2025-53544Trilium Notes is an open-source, cross-platform hierarchical…7.5
• CVE-2025-53545Press, a Frappe custom app that runs Frappe Cloud, manages i…6.9
• CVE-2025-53547Helm is a package manager for Charts for Kubernetes. Prior t…8.6
• CVE-2025-53548Clerk helps developers build user management. Applications t…7.5
• CVE-2025-53549The Matrix Rust SDK is a collection of libraries that make i…5.2
• CVE-2025-53557A heap-based buffer overflow vulnerability exists in the MFE…9.8
• CVE-2025-53558ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a c…8.8
• CVE-2025-53559Improper Neutralization of Input During Web Page Generation …7.1