{"vulnerability": "cve-2026-44359", "sightings": [{"uuid": "6aee8f8f-e33f-425d-96c2-f5406b208514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-44359", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116949361347720615", "content": "Meshtastic firmware (pre-2.7.21.1370b23) has a CRITICAL code injection flaw (CVE-2026-44359) in GitHub Actions (main_matrix.yml), risking repo secrets & supply chain compromise. Patch ASAP. https://radar.offseq.com/threat/cve-2026-44359-cwe-94-improper-control-of-generation-of-code-code-injection-in-meshtastic-firmware-dde9440ad0d78135 #OffSeq #CVE202644359 #Infosec", "creation_timestamp": "2026-07-20T00:00:37.451873Z"}, {"uuid": "6846be92-676c-425c-a59d-832b2e39dddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-44359", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqzygdpesx2r", "content": "Meshtastic firmware before 2.7.21.1370b23 is exposed to a CRITICAL code injection (CVE-2026-44359) in GitHub Actions. Update immediately to secure secrets & CI integrity. https://radar.offseq.com/threat/cve-2026-44359-cwe-94-improper-control-of-generation-of-code-code-injection-in-meshtastic-firm...", "creation_timestamp": "2026-07-20T00:00:38.902996Z"}, {"uuid": "6cf817ef-25b4-4a21-8865-cbff04c8e3d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr23rewlm32x", "content": "\ud83d\udd34 CVE-2026-44359 - Critical (10)\n\nMeshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Mesht...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-44359/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T01:00:29.855040Z"}, {"uuid": "d75347a0-cd83-45b7-bf73-c1fbbf469956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr24qtfxzh22", "content": "CVE-2026-44359\nThe Meshtastic open source mesh networking solution had a flaw in its GitHub workflow that could allow attackers to execute their own code and gain access to sensitive information. This issue has been fixed in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-20T01:18:04.993246Z"}, {"uuid": "66b726c5-bf1f-438f-839d-8f54ce5799e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr2744rfei2e", "content": "CVE-2026-44359 - Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow\nCVE ID : CVE-2026-44359\n \n Published : July 19, 2026, 11:06 p.m. | 1\u00a0hour, 5\u00a0minutes ago\n \n Description : Meshtastic is an open source mesh netwo...", "creation_timestamp": "2026-07-20T02:00:11.512337Z"}, {"uuid": "7a643df8-44fc-460c-bda5-6fd8ae54eef2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr2fhogj752w", "content": "Meshtastic v2.7.21.1370b23\u4ee5\u524d\u3001CI\u30ef\u30fc\u30af\u30d5\u30ed\u30fc\u3067\u5916\u90e8\u304b\u3089\u306e\u30d7\u30eb\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u304c\u30ea\u30dd\u30b8\u30c8\u30ea\u306e\u79d8\u5bc6\u60c5\u5831\u3084\u6a29\u9650\u3092\u60aa\u7528\u3057\u3001\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u8106\u5f31\u6027\u304c\u3042\u3063\u305f\u3002\nCVE-2026-44359 CVSS 10.0 | CRITICAL", "creation_timestamp": "2026-07-20T03:54:01.354025Z"}, {"uuid": "4b0e705e-0fab-4b3b-937d-7f2e8e0c5d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr2jjgy3i627", "content": "CVE-2026-44359 - Critical CI/CD command injection in Meshtastic. CVSS 10. Unpatched. Attacker code executed with repo secrets access via pull_request_target. No approval gate. Disable workflow or restrict PR access immediately. #CVE #infose...\n\nhttps://www.valtersit.com/cve/CVE-2026-44359/", "creation_timestamp": "2026-07-20T05:06:35.835545Z"}, {"uuid": "0f9ff0cd-46ab-4919-a9df-cad4f1652181", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-44359", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/116950564557329063", "content": "CVE-2026-44359 - Critical CI/CD command injection in Meshtastic. CVSS 10. Unpatched. Attacker code executed with repo secrets access via pull_request_target. No approval gate. Disable workflow or restrict PR access immediately. #CVE #infosec #Meshtastic\nhttps://www.valtersit.com/cve/CVE-2026-44359/", "creation_timestamp": "2026-07-20T05:06:36.046217Z"}]}