{"action":"No fix published. Pin and monitor.","affected":[],"component":"coreshop/core-shop","cve_ids":["CVE-2026-41249"],"ecosystem":"Packagist","epss":0.00549,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q58j-g3f4-h26h","id":"tcs_01M5KF6YY4HH1QAPHBMRKWEJ05","modified_at":"2026-09-10T03:51:06.807111227Z","published_at":"2026-05-14T13:18:16Z","references":["https://osv.dev/vulnerability/GHSA-q58j-g3f4-h26h","https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h","https://nvd.nist.gov/vuln/detail/CVE-2026-41249","https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4","https://github.com/coreshop/CoreShop","https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-q58j-g3f4-h26h","url":"https://osv.dev/vulnerability/GHSA-q58j-g3f4-h26h"}],"summary":"CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration"}