CVE-2026-65820: aeon: pull_request_target CI flaw enables token theft

aeon, a scikit-learn-compatible time series library, had a GitHub Actions workflow that used pull_request_target and ran fork-controlled code with elevated credentials, which could let an attacker steal the repository token or push to branches. The flaw sits in the project's CI pipeline, not in the library code that runs in your environments, so the immediate risk is to the maintainers and to anyone who consumes aeon builds. There is no CISA KEV listing, no public exploit and no scanner template, and EPSS and CVSS data are not yet available, so the likelihood of mass exploitation is low. The real concern is supply chain: a compromised repository write path could in theory be used to tamper with future releases. Upgrade to aeon 1.5.0, pin dependencies by hash, and verify that your own repositories do not run untrusted fork code under pull_request_target.

No confirmed active exploitation of CVE-2026-65820 has been reported, but organizations should still patch proactively.

1) Upgrade to aeon 1.5.0 or later. 2) Pin aeon and its dependencies to verified versions and hashes, and review changelogs for unexpected changes. 3) Audit your own GitHub workflows for pull_request_target combined with checkout of fork code (head.sha or head.ref), and replace it with pull_request or a split unprivileged/privileged workflow design. 4) Restrict GITHUB_TOKEN to the minimum permissions and avoid auto-commit or push steps on fork branches. 5) Rotate any tokens that may have been exposed to such workflows and review workflow run logs and repository audit logs for unusual pushes. 6) Use SCA tooling to flag aeon versions below 1.5.0.

This vulnerability affects the following AI/ML architecture patterns: training pipelines, time series ML pipelines, CI/CD pipelines for ML libraries, open-source ML dependency supply chain.

No CVSS score has been assigned yet.