A vulnerability was found in tektoncd pipeline up to 1.11.0. It has been declared as critical. Affected is the function
validateRepoURL. Such manipulation leads to argument injection.
This vulnerability is uniquely identified as CVE-2026-40938. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
