CVE-2026-44723

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run_tests_model_gen_and_load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull_request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit.

• CWE-78
• CWE-1336

• https://github.com/VowpalWabbit/vowpal_wabbit/commit/998e390e80a7e8192d7849b7784bc113dbd190adPatch
• https://github.com/VowpalWabbit/vowpal_wabbit/security/advisories/GHSA-cg2g-xgg7-3xxqExploit, Mitigation, Vendor Advisory
• https://github.com/VowpalWabbit/vowpal_wabbit/security/advisories/GHSA-cg2g-xgg7-3xxqExploit, Mitigation, Vendor Advisory

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44718Mathesar is a web application that makes working with Postgr…5.3
• CVE-2026-44719Mathesar is a web application that makes working with Postgr…5.3
• CVE-2026-4472A security vulnerability has been detected in itsourcecode O…9.8
• CVE-2026-44720OpenLearnX is an open-source, decentralized learning and ass…6.9
• CVE-2026-44721Open WebUI is a self-hosted artificial intelligence platform…7.3
• CVE-2026-44722pyzipper is a replacement for Python's zipfile that can read…6.2
• CVE-2026-44724systeminformation is a System and OS information library for…7.8
• CVE-2026-44726Deno is a JavaScript, TypeScript, and WebAssembly runtime. F…9.1
• CVE-2026-44727Jupyter Server is the backend for Jupyter web applications. …5.4
• CVE-2026-44728Babel is a compiler for writing next generation JavaScript. …7.8
• CVE-2026-44729Twenty is an open source CRM. In 1.18.0 and earlier, the fil…8.7
• CVE-2026-4473A vulnerability was detected in itsourcecode Online Doctor A…9.8