Security readout for executives and security teams
Plain-English summary
CVE-2026-27701 affects LiveCodes’ GitHub Actions automation, not the client-side playground runtime directly. A malicious pull request title could be interpreted as JavaScript inside a workflow, allowing actions under the CI bot’s privileges. The main business risk is compromise of repository secrets and unauthorized GitHub operations if the vulnerable workflow is reachable.
Executive priority
Prioritize remediation for any organization maintaining LiveCodes forks or CI workflows with repository secrets. Treat as high urgency for maintainers because compromise could expose secrets or allow unauthorized repository changes. Lower priority if you only use LiveCodes and do not run its GitHub Actions workflows.
Technical view
Before commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCodes’ i18n-update-pull workflow interpolated an untrusted PR title into an actions/github-script JavaScript block. This is CWE-94 code injection. The advisory states arbitrary JavaScript could run with CI bot token credentials, including CI_APP_ID and CI_APP_PRIVATE_KEY.
Likely exposure
Exposure is limited to LiveCodes repositories or derived forks using the vulnerable i18n-update-pull GitHub Actions workflow before the fixing commit. Organizations only consuming hosted LiveCodes should verify relevance, because the described issue is in repository CI automation.
Exploitation context
Sources describe a crafted PR title and a triggering issue comment as prerequisites. The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The impact centers on CI token privileges, repository secrets, and GitHub API actions.
Researcher notes
The provided record assigns CVSS 4.0 score 8.8, vector AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N. Affected version is listed as before commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11. Evidence is limited to the CVE record, GitHub advisory, and fixing commit.
Mitigation direction
- Update LiveCodes to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 or later.
- Review forks for the same vulnerable workflow pattern.
- Rotate CI_APP_ID, CI_APP_PRIVATE_KEY, and related CI secrets if exposure is suspected.
- Review GitHub Actions runs and audit logs for unusual bot-token activity.
- Follow the GitHub advisory for any additional vendor guidance.
Validation and detection
- Confirm the repository contains commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11 or equivalent fix.
- Inspect i18n-update-pull workflow for direct PR title interpolation into github-script.
- Inventory repositories forked from or based on live-codes/livecodes.
- Check whether CI_APP_ID and CI_APP_PRIVATE_KEY were available to the workflow.
- Review recent workflow logs for unexpected repository or GitHub API activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27701 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/live-codes/livecodes/security/advisories/GHSA-xh9w-5859-x97jCVE reference · x_refsource_CONFIRM
- https://github.com/live-codes/livecodes/commit/e151c64c2bd80d2d53ac1333f1df9429fe6a1a11CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.