CVE-2026-41249
1 advisory.
Packagist/coreshop/core-shop CVE-2026-41249: high 8.2, EPSS 0.55%
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
Action: No fix published. Pin and monitor.
Affected
No affected ranges in the source.
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-q58j-g3f4-h26h
- https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h
- https://nvd.nist.gov/vuln/detail/CVE-2026-41249
- https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4
- https://github.com/coreshop/CoreShop
- https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14
CVE-2026-41249 · published · modified · JSON