CVE-2026-116964 — Konflux-ci: remote code execution via eval() in manifest scripts

A code-generation control flaw was found in konflux-ci. An attacker with repository write access can inject shell commands into environment export scripts, causing manifest synchronization scripts to dynamically evaluate unvalidated script output.