CVE-2026-39087: ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

April 23, 2026 (updated May 8, 2026)

An issue in Ntfy ntfy.sh before v.2.22.0 allows a remote attacker to execute arbitrary code via the parseActions function.

References

gist.github.com/MightyNawaf/5d41d6e8ead16e217f86b016002ecae5
github.com/advisories/GHSA-pqhx-w72w-m393
github.com/binwiederhier/ntfy/releases/tag/v2.22.0
nvd.nist.gov/vuln/detail/CVE-2026-39087

Code Behaviors & Features

Detect and mitigate CVE-2026-39087 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →