{"schema":"threatline.record/2","record":{"id":"CVE-2026-94620","aliases":["GHSA-qx2g-vpwq-466c"],"summary":"Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)","details":"Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a **symlink** (materialized verbatim by `git clone`) could redirect the teacher's write to an arbitrary path — e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file that git subsequently executes. The written bytes are attacker-controlled (the student's uploaded release asset for `result.json`; student-chosen submit-tag names for `results.json`). This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization. Version 1.11.0 contains a patch. Some workarounds are available. Avoid running `gh teacher download` against untrusted student repositories, or run it inside a disposable sandbox / container with no access to sensitive host files or credentials. Inspect cloned trees for symlinked, hardlinked, or special (`result.json`/`results.json`) entries before allowing the artifact-refresh step to run.","categories":["Unclassified"],"product":"classroom50","vendor":"foundation50","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-94620","source_modified_at":"2026-10-01T16:18:58.240Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"classroom50","vendor":"foundation50","versions":[{"status":"affected","version":"< 1.11.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/foundation50/classroom50/security/advisories/GHSA-qx2g-vpwq-466c","source_modified_at":"2026-09-23T14:28:02Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"go","name":"github.com/foundation50/gh-teacher"},"range":"< 1.11.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/foundation50/classroom50/security/advisories/GHSA-qx2g-vpwq-466c","source_modified_at":"2026-09-23T14:28:02Z","fetched_at":"2026-10-23T19:00:29.328130Z","package":{"ecosystem":"go","name":"github.com/foundation50/gh-teacher"},"version":"1.11.0"}],"cvss":9.4,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00415,"percentile":0.34791,"score_date":"2026-10-23"},"published_at":"2026-10-01T15:38:09.062Z","modified_at":"2026-10-01T16:18:58.240Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-94620","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T16:18:58.240Z"},{"source":"GitHub Advisory Database","url":"https://github.com/foundation50/classroom50/security/advisories/GHSA-qx2g-vpwq-466c","fetched_at":"2026-10-23T19:00:29.328130Z","source_modified_at":"2026-09-23T14:28:02Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94620","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/foundation50/classroom50/security/advisories/GHSA-qx2g-vpwq-466c","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/foundation50/classroom50/commit/79112f33932d1b5c398a8801d97a8813d52d55ce","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-01T16:17:49.043303Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T16:18:58.240Z","content_hash":"72394703696986ee11398f59efd5cb9d8a0f4ca1ee52a457fb6288f4dfaa0acf"}}