CVE-2026-76826
Description
A flaw was found in tsParticles. The automated release workflow interpolates release note text directly into a shell command without proper sanitization. A remote attacker or contributor can exploit this vulnerability by submitting content containing shell control characters, leading to arbitrary code execution within the automated build environment when a maintainer initiates a release. Successful exploitation could allow an attacker to modify released artifacts or compromise workflow tokens with elevated permissions.
Statement
This vulnerability is rated as an Important severity because untrusted contributor input can trigger arbitrary shell execution within release automation, potentially compromising pipeline tokens and downstream artifacts. The defect is confined to upstream GitHub Actions deployment workflows rather than runtime library functionality. Standard Red Hat enterprise runtime deployments and downstream consumers are not directly exposed to this CI/CD pipeline flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
