PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47174 duck-organization CVE debrief

CVE-2026-47174 is a critical vulnerability in Duck Site, a software product with an unknown vendor. The vulnerability has a CVSS score of 9.5 and a severity of CRITICAL. The issue arises from the deploy workflow in Duck Site, which runs after the build workflow completes. The build workflow runs on pull requests, while the deploy workflow runs with package-write permissions and deployment secrets. An attacker can exploit this vulnerability by making a pull request build satisfy the deploy workflow's main branch condition, allowing attacker-controlled pull request code to become the deployed production site image without being merged.

Vendor
duck-organization
Product
duck-site
CVSS
CRITICAL 9.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-06-11
Advisory published
2026-06-11
Advisory updated
2026-06-11

Who should care

Users of Duck Site before version 1.0.1 should be aware of this vulnerability and take immediate action to patch their systems.

Technical summary

The vulnerability is caused by the deploy workflow in Duck Site, which runs with elevated permissions and allows an attacker to deploy malicious code to production without merging it. The issue has been patched in version 1.0.1.

Defensive priority

high

Recommended defensive actions

  • Upgrade to Duck Site version 1.0.1 or later.
  • Review and restrict deploy workflow permissions.
  • Monitor for suspicious pull requests and deployments.

Evidence notes

The vulnerability was patched in version 1.0.1 of Duck Site.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47174 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47174

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47174 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47174

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.