Answer in brief
CVE-2026-55094 records a High severity (CVSS 8.7) vulnerability in Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`). The current sources do not mark it as known exploited. The current feed maps taskcluster/taskcluster (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps taskcluster/taskcluster (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| taskcluster/taskclustergeneric | <100.3.0 | 100.3.0 |
Published upstream
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 30, 2026
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.
Quoted source text, attributed separately from HOL analysis.