CVE-2026-22869: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22869 is a critical arbitrary code execution vulnerability in the GitHub Actions CI workflow (.github/workflows/ci.yml) of Eigent, a multi-agent Workforce platform. The flaw allows unauthenticated attackers submitting fork pull requests to execute arbitrary code with repository write permissions. It affects all Eigent versions prior to the patch committed on January 13, 2026 (commit bf02500). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The vulnerable CI workflow used the pull_request_target event trigger — which runs with repository write permissions and access to secrets — combined with actions/checkout@v3 referencing the PR's head SHA (ref: ${{ github.event.pull_request.head.sha }}), thereby checking out and executing untrusted code from a fork. An attacker can exploit this by placing a malicious script at node_modules/.bin/markdownlint-cli in their fork; when the workflow runs npx markdownlint-cli, Node's npx resolves the local node_modules/.bin/ path first, executing the attacker's script instead of the legitimate tool. No special privileges or user interaction are required — simply opening a pull request against the main branch is sufficient to trigger the workflow (GitHub Advisory, PoC PR #836).

Successful exploitation grants an attacker arbitrary code execution within the CI/CD environment with the elevated permissions of the GITHUB_TOKEN, including repository write access. Demonstrated impacts include extraction of git authentication credentials, posting unauthorized comments on pull requests, exfiltration of repository data and secrets to external servers, and the potential to push malicious code or create tampered releases — constituting a supply chain attack risk. Confidentiality, integrity, and availability of the repository and its downstream consumers are all rated HIGH (GitHub Advisory, Fix PR #837).

A working proof-of-concept was publicly demonstrated in PR #836 by researcher ColeMurray, which successfully executed arbitrary JavaScript in the CI environment, extracted git credentials (97 bytes of authentication header), posted a comment on the PR using those credentials, and exfiltrated data to an external server (PoC PR #836). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.061%, indicating low current automated exploitation probability. No evidence of in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify the target repository (eigent-ai/eigent) as using a pull_request_target CI workflow that checks out PR code, by inspecting the public .github/workflows/ci.yml file.
2. Fork the repository: Create a fork of eigent-ai/eigent under an attacker-controlled GitHub account.
3. Plant malicious script: In the fork, create node_modules/.bin/markdownlint-cli containing arbitrary JavaScript or shell commands (e.g., code to extract GITHUB_TOKEN, environment variables, and exfiltrate them via curl to an attacker-controlled server).
4. Create a trigger file: Add or modify any .md file in the fork to satisfy the workflow's path filter condition that triggers the markdown linting job.
5. Open a pull request: Submit a PR from the fork branch targeting eigent-ai/eigent:main. This triggers the pull_request_target workflow with write permissions and secrets access.
6. Code execution: The CI workflow checks out the attacker's fork code and runs npx markdownlint-cli. Since npx resolves node_modules/.bin/ first, the attacker's malicious script executes with the elevated GITHUB_TOKEN permissions.
7. Credential theft and post-exploitation: The malicious script extracts the git authentication header and GITHUB_TOKEN, posts a comment on the PR (demonstrating write access), and exfiltrates secrets to an external server. Optionally, the attacker can push malicious commits or create releases (GitHub Advisory, PoC PR #836).

• GitHub Actions Logs: CI workflow runs triggered by pull_request_target events from fork repositories; unexpected github-actions[bot] comments on PRs containing phrases like "Security PoC - Write Access Demonstrated" or references to arbitrary code execution.
• Network: Outbound HTTP requests from the GitHub Actions runner to unexpected external IP addresses or domains (data exfiltration via curl or similar tools) during CI job execution.
• File System (Runner): Presence of node_modules/.bin/markdownlint-cli in the checked-out PR code that is not the legitimate markdownlint binary; unexpected scripts in node_modules/.bin/ directory.
• Logs: GitHub audit log entries showing GITHUB_TOKEN used to post comments or push code from an Actions runner associated with a fork PR; workflow run IDs from fork PRs performing write operations.
• Process: Unexpected child processes spawned during the npx markdownlint-cli step, such as curl, wget, bash, or Node.js scripts making outbound network connections (PoC PR #836, GitHub Advisory).

The fix was merged on January 13, 2026 via commit bf02500 (PR #837). The remediation splits the vulnerable workflow into two separate files: ci.yml (using pull_request_target for PR commenting only, with no code checkout) and lint-markdown.yml (using the safer pull_request trigger with read-only permissions and no secrets access for linting). Additional hardening measures include pinning markdownlint-cli to a specific version (@0.43.0) to prevent supply chain attacks via npx, and updating GitHub Actions to latest versions (checkout@v4, github-script@v7). Organizations using similar CI patterns should: (1) never combine pull_request_target with checkout of PR head code, (2) restrict GITHUB_TOKEN permissions to the minimum required, and (3) review all workflows for this anti-pattern (Fix PR #837, Fix Commit).

The vulnerability was discovered and responsibly disclosed by security researcher ColeMurray, who submitted both the PoC (PR #836) and the fix (PR #837) on January 13, 2026. The fix was promptly reviewed and merged by Eigent maintainer Wendong-Fan the same day with the comment "thanks @ColeMurray for the contribution!" The case was noted in security community aggregators including Red Hat's CVE tracking and the Secret CISO newsletter, highlighting it as part of a broader pattern of pull_request_target misuse in GitHub Actions workflows (Fix PR #837, Red Hat CVE).