RCE in Maaassistantarknights

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull_request.title into a run: shell command during the…

Vulnerability class: Command Injection (OS Command Injection)

Affected products

Maaassistantarknights — versions < cafc3946059e6337d2089d4fec8b6885ba17c332

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)