CVE-2026-42298

A GitHub Actions workflow named 'Build and Publish PR Docker Image' (.github/workflows/pr-docker-build.yml) runs automatically in response to Pull Requests from external repository forks. An attacker can open a Pull Request from a fork where they have maliciously modified the Dockerfile.dev file. During automatic Docker image building in the context of the victim's repository, the injected code is executed with access to the GITHUB_TOKEN environment variable that has write-all permissions for all resources. This allows token exfiltration and further actions within the repository context.

An attacker can execute arbitrary code in the CI/CD environment, steal the GITHUB_TOKEN with write-all permissions, and then modify source code, publish malicious packages, manipulate releases, or gain access to repository secrets.

The repository should be updated to a version containing commit da44801, which removes the vulnerable workflow configuration. Details available in the vendor's security advisory: GHSA-v975-9h5p-xhm4

Postiz application (postiz-app) in versions before commit da44801 — affects instances using the vulnerable GitHub Actions workflow (.github/workflows/pr-docker-build.yml)