OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work.
This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/OmniBlocks/monorepo/commit/2953ef77649fc3c206fc1ee306f74cedc…
security-advisories@github.com
https://github.com/OmniBlocks/monorepo/commit/627e0f0a16a7d74b09128106b57dd7e85…
security-advisories@github.com
https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq
security-advisories@github.com