OpenLIT is an open source platform for AI engineering.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged and numerous sensitive secrets (API keys, database/vector store toke

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged and numerous sensitive secrets (API keys, database/vector store toke

Affected

• cpe openlit/openlit software development kitversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-27941

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27941

  OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the event while checking out and executing untrusted code from forked pull requests. These workflows run with

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com