QSearchQSearch

CVE-2026-47174

In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes

Published: 2026-06-11 · Last updated: 2026-06-11

Severity and scoring

CWE
CWE-829

Description

In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. If an attacker can make a pull request build satisfy the deploy workflow’s main branch condition, the deploy job checks out the triggering workflow commit, builds it into a Docker image, pushes it as latest, and triggers Dokploy deployment. This can allow attacker-controlled pull request code to become the deployed production site image without being merged. This issue has been patched in version 1.0.1.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-53810 — OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading towar... (8.8 HIGH)
  • CVE-2026-52858 — Vim is an open source, command line text editor
  • CVE-2026-47172 — Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support
  • CVE-2026-46529 — Atril Document Viewer is the default document reader of the MATE desktop environment for Linux
  • CVE-2026-47292 — Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally (7.8 HIGH)