onyx --cves cve-2026-34243

CVE-2026-34243

score: 0.2
cvss: 9.8
epss: 2.8%
published: 2026-03-31
kev added: —
first seen: 2026-10-21

wenxian <= 0.3.1 contains a command injection caused by untrusted user input from issue_comment.body used directly in a shell command in GitHub Actions workflow, letting attackers execute arbitrary code on the runner, exploit requires crafted issue comment.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2026-03-31 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-77

References 1

https://github.com/njzjz/wenxian/security/advisories/GHSA-r4fj-r33x-8v88