CoreShop versions 5.0.1 through 5.1.0‑beta.1 contain a GitHub Actions workflow that is triggered by pull_request_target events. The workflow checks out the code from the pull request head and executes the bin/console script from that unverified checkout. This flaw is a classic instance of CWE‑94, reflected by the execution of arbitrary code supplied by an attacker. The result is that any external contributor or fork can submit a malicious pull request and cause the GitHub Actions runner to run attacker‑controlled commands, yielding full remote code execution on the runner environment.

The affected system is the CoreShop eCommerce platform from the coreshop vendor. Installations running CoreShop versions 5.0.1 up to and including 5.1.0‑beta.1 are impacted because the vulnerable workflow is present in the repository for these releases.

The CVSS score of 8.2 classifies the issue as high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, so the contemporary exploitation probability is uncertain. However, the straightforward attack path—creating or modifying a pull request—makes it an attractive vector for adversaries that target open‑source project pipelines. Until a vendor patch is applied or the workflow is corrected, the risk remains elevated for any repository using the unsafe trigger.