Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by OmniBlocks

    CVE-2026-54594 (GCVE-0-2026-54594)

    Vulnerability from nvd – Published: 2026-09-17 19:51 – Updated: 2026-09-18 20:09
    VLAI
    Title
    OmniBlocks: Spamming in Discussions tab possible via disc.yml
    Summary
    OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:09 UTC
    CWE
    • CWE-799 - Improper Control of Interaction Frequency
    Assigner
    References
    Impacted products
    Vendor Product Version
    OmniBlocks monorepo Affected: < OmniBlocks
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54594",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:09:08.371650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:09:27.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "monorepo",
          "vendor": "OmniBlocks",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c OmniBlocks"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-799",
              "description": "CWE-799: Improper Control of Interaction Frequency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T19:51:32.309Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df"
        }
      ],
      "source": {
        "advisory": "GHSA-pq9c-3595-72jq",
        "discovery": "UNKNOWN"
      },
      "title": "OmniBlocks: Spamming in Discussions tab possible via disc.yml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54594",
    "datePublished": "2026-09-17T19:51:32.309Z",
    "dateReserved": "2026-06-15T19:45:23.539Z",
    "dateUpdated": "2026-09-18T20:09:27.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54594 (GCVE-0-2026-54594)

    Vulnerability from cvelistv5 – Published: 2026-09-17 19:51 – Updated: 2026-09-18 20:09
    VLAI
    Title
    OmniBlocks: Spamming in Discussions tab possible via disc.yml
    Summary
    OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:09 UTC
    CWE
    • CWE-799 - Improper Control of Interaction Frequency
    Assigner
    References
    Impacted products
    Vendor Product Version
    OmniBlocks monorepo Affected: < OmniBlocks
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54594",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:09:08.371650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:09:27.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "monorepo",
          "vendor": "OmniBlocks",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c OmniBlocks"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-799",
              "description": "CWE-799: Improper Control of Interaction Frequency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T19:51:32.309Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df"
        }
      ],
      "source": {
        "advisory": "GHSA-pq9c-3595-72jq",
        "discovery": "UNKNOWN"
      },
      "title": "OmniBlocks: Spamming in Discussions tab possible via disc.yml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54594",
    "datePublished": "2026-09-17T19:51:32.309Z",
    "dateReserved": "2026-06-15T19:45:23.539Z",
    "dateUpdated": "2026-09-18T20:09:27.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}