{"id":"CVE-2026-34243","title":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title)","summary":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell com…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-77","CWE-78"],"vendor":"njzjz","product":"wenxian","affected":["wenxian <= 0.3.1"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34243","references":[{"url":"https://github.com/njzjz/wenxian/security/advisories/GHSA-r4fj-r33x-8v88","label":"security-advisories@github.com"}],"tags":["nvd","exploit-available"],"epss":0.02172,"epssPercentile":0.81281,"ingestedAt":"2026-07-24T20:38:02.519Z","exploits":{"github":1,"githubRepos":["https://github.com/pvharmo2/gha-lab-85f022290a"],"checkedAt":"2026-09-21T15:28:44.542Z"},"exploitAvailable":true,"slug":"CVE-2026-34243","body":"## Overview\n\nwenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.\n\n## Affected\n\n- `wenxian <= 0.3.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":5126,"id":"CVE-2026-34243","ts":1788887249150,"field":"exploit_available","old":"false","new":"true"},{"seq":4009,"id":"CVE-2026-34243","ts":1788886364854,"field":"exploit_available","old":"true","new":"false"},{"seq":2821,"id":"CVE-2026-34243","ts":1788883031550,"field":"exploit_available","old":"false","new":"true"},{"seq":1850,"id":"CVE-2026-34243","ts":1788882434454,"field":"exploit_available","old":"true","new":"false"},{"seq":948,"id":"CVE-2026-34243","ts":1788881868487,"field":"exploit_available","old":"false","new":"true"}]}