CVE-2026-76826

CVSS 7.5 (high) · published 2026-11-04

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.

Weakness: CWE-78

Source: NVD CVE-2026-76826

References

• https://github.com/tsparticles/tsparticles/commit/d3b5672bd61bb847abfa21193c34eabf7aba6896
• https://github.com/tsparticles/tsparticles/pull/5888
• https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx
• https://github.com/tsparticles/tsparticles/security/advisories/GHSA-gw8q-3x59-mjjx

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.