A critical code injection vulnerability in OWASP BLT allows unauthenticated attackers to achieve remote code execution in the CI environment, potentially leading to total repository compromise.

The vulnerability exists in the .github/workflows/regenerate-migrations.yml file, which uses the pull_request_target trigger with excessive permissions. An unauthenticated attacker can submit a pull request containing malicious Python code that executes during the Django migration process when a maintainer triggers the workflow.

Successful exploitation allows an attacker to gain full control over the CI runner environment, granting them access to repository secrets and the GITHUB_TOKEN. This presents a severe risk of supply chain compromise, unauthorized code modification, and potential exfiltration of sensitive organizational credentials. Given the CVSS score of 8.8, this flaw represents a high-severity threat that could lead to widespread system and integrity degradation.

Immediate Action: Upgrade to version 2.1.1 or later as soon as the vendor makes the release available. Until then, restrict the ability of untrusted contributors to trigger workflows that utilize high-privilege GITHUB_TOKEN permissions.

Proactive Monitoring: Review CI/CD pipeline logs for unexpected execution of migration scripts or unauthorized access attempts from external contributors. Monitor repository secrets for signs of unauthorized usage or access.

Compensating Controls: Disable the affected workflow or remove the pull_request_target trigger mechanism until a patch is applied. Implement branch protection rules to prevent untrusted code from entering the main repository without rigorous manual review.

Public Exploit Available: Unknown.

Organizations utilizing OWASP BLT must treat this vulnerability with high urgency due to the potential for complete environment compromise. Security teams should prepare to deploy version 2.1.1 immediately upon release and enforce strict controls over CI/CD workflow triggers in the interim to prevent unauthorized code execution.