CVE-2026-54594 (GCVE-0-2026-54594)
Vulnerability from cvelistv5
Published
2026-09-17 19:51
Modified
2026-09-18 20:09
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-799 - Improper Control of Interaction Frequency
Summary
OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.
References
Impacted products
Vendor Product Version
OmniBlocks monorepo Version: < OmniBlocks
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54594",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:09:08.371650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:09:27.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "monorepo",
          "vendor": "OmniBlocks",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c OmniBlocks"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-799",
              "description": "CWE-799: Improper Control of Interaction Frequency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T19:51:32.309Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3"
        },
        {
          "name": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df"
        }
      ],
      "source": {
        "advisory": "GHSA-pq9c-3595-72jq",
        "discovery": "UNKNOWN"
      },
      "title": "OmniBlocks: Spamming in Discussions tab possible via disc.yml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54594",
    "datePublished": "2026-09-17T19:51:32.309Z",
    "dateReserved": "2026-06-15T19:45:23.539Z",
    "dateUpdated": "2026-09-18T20:09:27.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54594\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-18T20:09:08.371650Z\"}}}], \"references\": [{\"url\": \"https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-18T20:09:24.148Z\"}}], \"cna\": {\"title\": \"OmniBlocks: Spamming in Discussions tab possible via disc.yml\", \"source\": {\"advisory\": \"GHSA-pq9c-3595-72jq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"OmniBlocks\", \"product\": \"monorepo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c OmniBlocks\"}]}], \"references\": [{\"url\": \"https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq\", \"name\": \"https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3\", \"name\": \"https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc31b67e3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df\", \"name\": \"https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85d2545df\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-799\", \"description\": \"CWE-799: Improper Control of Interaction Frequency\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-17T19:51:32.309Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54594\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-18T20:09:27.955Z\", \"dateReserved\": \"2026-06-15T19:45:23.539Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-17T19:51:32.309Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.