CVE-2026-44723 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-44723CRITICAL

VowpalWabbit vowpal_wabbit — Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0047   38.8     —

AFFECTED
  Product        Versions                                      Fixed
  vowpal_wabbit  < 998e390e80a7e8192d7849b7784bc113dbd190ad –  —

TIMELINE
  May 7   Reserved by GitHub_M
  May 26  EXPLOIT PUBLISHED — CVE-2026-44723 (VowpalWabbit vowpal_wabbit). Public exploit reference added.
  May 26  Published (CNA: GitHub_M)

CWE-78, CWE-1336 · CNA: GitHub_M · CVSS v3.1 · 2 references · NVD status: Analyzed

Description

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run_tests_model_gen_and_load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull_request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 7, 2026	Reserved	Reserved by GitHub_M
May 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-44723 (VowpalWabbit vowpal_wabbit). Public exploit reference added.
May 26, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
VowpalWabbit	vowpal_wabbit	—	< 998e390e80a7e8192d7849b7784bc113dbd190ad	—

Weaknesses

CWE-78 · CWE-1336

References (2)

https://github.com/VowpalWabbit/vowpal_wabbit/commit/998e390e80a7e8192d7849b7784bc113dbd190ad [Patch]
https://github.com/VowpalWabbit/vowpal_wabbit/security/advisories/GHSA-cg2g-xgg7-3xxq [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-44723 at cve.org

Vendors: vowpalwabbit

Weaknesses: CWE-78 · CWE-1336

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-44723 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.