Classroom 50 writes autograde artifacts into the directory that it clones from each student’s repository. Because the write operation follows symbolic links, a student can embed a symlink in result.json or results.json that points to a sensitive file on the teacher’s machine. The tool then overwrites that file with attacker‑controlled data, enabling the attacker to inject arbitrary content such as a malicious SSH key, a cron job, or scripts that are later executed by Git. The teacher’s gh token has organization‑wide admin privileges, making the malicious file writes a path to remote code execution with high privilege.

The vulnerability applies to the Foundation50 Classroom 50 tool prior to version 1.11.0. Any installation that runs the gh teacher download command against student repositories hosted on GitHub is affected. The tool is typically deployed on a teacher’s workstation or CI environment that has access to the organization‑wide gh token.

The CVSS base score of 9.4 denotes critical severity. The EPSS score is not provided, so current exploitation probability is unknown, but the vulnerability has been publicly disclosed and the KEV catalog does not list it, indicating it may not yet be actively exploited. The attack requires a student who can commit a repository with a symlinked result.json file; the teacher triggers gh teacher download. This is a local‑host attack from the teacher’s machine that could lead to complete compromise of the teacher’s system or organization. It is considered high risk for environments where student repositories are not fully trusted.