CVE Explorer

CVE-2026-27938

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull_request.body }}` inside a `run:` shell block. When a pull request from `develop` to `master` is merged, the PR body is injected verbatim into a shell command, allowing arbitrary command execution on the Actions runner. Version 2.9.1 contains a fix for

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3f41318d47aaddf82b0984e06d1c5f12700d8a49f81c768b78ba7c549f54c5ac

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"wp-graphql","vendor":"wp-graphql","versions":[{"status":"affected","version":"< 2.9.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:e7cbaba534db1d7ce745f597265c4c99318498a01190b104459e41e79cb8ac04 · sha256:751820f6dbca4040… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:e7cbaba534db1d7ce745f597265c4c99318498a01190b104459e41e79cb8ac04 · sha256:751820f6dbca4040… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:e7cbaba534db1d7ce745f597265c4c99318498a01190b104459e41e79cb8ac04 · sha256:751820f6dbca4040… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/wp-graphql/wp-graphql/commit/de0c2d590593f1099546ad517106e454a498bc58","tags":["x_refsource_MISC"],"url":"https://github.com/wp-graphql/wp-graphql/commit/de0c2d590593f1099546ad517106e454a498bc58"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:e7cbaba534db1d7ce745f597265c4c99318498a01190b104459e41e79cb8ac04 · sha256:751820f6dbca4040… · /containers/cna/references/1

{"name":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4q9f-mjxf-rx7x","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4q9f-mjxf-rx7x"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:e7cbaba534db1d7ce745f597265c4c99318498a01190b104459e41e79cb8ac04 · sha256:751820f6dbca4040… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer