What is CVE-2026-24480?
QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, was vulnerable to remote code execution and repository compromise because it used the `pull_request_target` trigger and then checked out and executed untrusted pull request code in a privileged context. Workflows triggered by `pull_request_target` ran with the base repository's credentials and access to secrets. If these workflows then checked out and executed code from the head of an external pull request (which could have been attacker controlled), the attacker could have executed arbitrary commands with elevated privileges. This insecure pattern has been documented as a security risk by GitHub and security researchers. Commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 removed the vulnerable code.
The record classifies CVE-2026-24480 under weakness class CWE-863. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 251 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 8.7 — High (derived from score)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EPSS (FIRST)
- 0.4% probability of exploitation in the next 30 days, higher than 33.5% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 7.7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-01-27
Is CVE-2026-24480 being exploited?
Weaponised exploit code for CVE-2026-24480 is publicly available. 1 public proof-of-concept repository is tracked for this identifier.
- trickest/cve (trickest)
Affected products and versions
- qgis: QGIS
How to fix CVE-2026-24480
No vendor patch reference has been recorded for CVE-2026-24480 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-24480
1 tracked threat in the Threadlinqs corpus references CVE-2026-24480, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, NVD, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.