{"affected":[{"product":"aeon","source":"CNA: GitHub_M","vendor":"aeon-toolkit","versions":[{"status":"affected","version":"< 1.5.0"}]}],"cveId":"CVE-2026-65820","cwes":["CWE-94"],"description":"aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be checked out and executed in a privileged context. The vulnerable workflow also generated/used elevated credentials and could automatically commit or push fixes back to pull request branches. This created a potential token exposure and repository write path if an attacker submitted a malicious fork pull request designed to execute during the privileged workflow run. This issue has been patched in version 1.5.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794419331628,"publishedAt":1794419331628,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/aeon-toolkit/aeon/security/advisories/GHSA-mhg2-mc45-wrjr"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aeon-toolkit/aeon/pull/3394"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/aeon-toolkit/aeon/commit/99261e1355c89a316bf0824bb03f855c6aadae8f"}],"remediation":[],"revision":"1fe3fdac08e32ba459c3e43fedcd653b16204770e4a818b387c3c900b71f5f74","sources":[{"modifiedAt":1794419331628,"name":"CNA: GitHub_M","retrievedAt":1794421538949,"url":"https://www.cve.org/CVERecord?id=CVE-2026-65820"}],"ssvc":null,"status":"published","title":"aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution","updatedAt":1794421538949}