A critical code injection vulnerability in the Meshtastic firmware repository allows unauthenticated attackers to execute malicious code via manipulated pull requests.

The vulnerability stems from improper control of code generation (CWE-94) and inclusion of functionality from untrusted sources (CWE-829), where GitHub workflows automatically execute attacker-supplied files from forks without approval.

This flaw carries a CVSS score of 10.0, indicating the highest level of risk. An attacker could achieve full repository takeover, compromise self-hosted runners, or inject malicious code into the firmware supply chain, resulting in widespread downstream impact for users of the mesh networking solution.

Immediate Action: Update the Meshtastic firmware repository and associated build workflows to version 2.7.21.1370b23 or later.

Proactive Monitoring: Review repository CI/CD logs for any unrecognized workflow execution patterns or unauthorized attempts to access repository secrets.

Compensating Controls: Disable automatic workflow triggers for pull requests from external contributors until the environment is fully patched.

Public Exploit Available: Unknown.

Due to the critical severity and the potential for supply chain poisoning, immediate remediation is required. Developers and maintainers must ensure all workflows are updated to the patched version to prevent unauthorized code execution.