CVE-2026-55094
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.
20
Improper Input Validation
StableCommon Consequences
Security Scopes Affected:
Availability
Confidentiality
Integrity
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Read Memory
Read Files Or Directories
Modify Memory
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML
94
Improper Control of Generation of Code ('Code Injection')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Integrity
Confidentiality
Availability
Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Interpreted
Technologies:
AI/ML
95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Access Control
Integrity
Availability
Other
Non-Repudiation
Potential Impacts:
Read Files Or Directories
Read Application Data
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Hide Activities
Applicable Platforms
Languages:
Java, JavaScript, Python, Perl, PHP, Ruby, Interpreted
Technologies:
AI/ML
250
Execution with Unnecessary Privileges
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Access Control
Potential Impacts:
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Read Application Data
Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies:
AI/ML, Mobile
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://bugzilla.mozilla.org/show_bug.cgi?id=2045091
https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f19…
https://github.com/taskcluster/taskcluster/issues/8716
https://github.com/taskcluster/taskcluster/pull/8718
https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0
https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2…