[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbjlbwLtmKS9eClVsbcYQUi3Z8kxe-R-Blq04fsyG5a4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"3216719e-fc5d-444d-b7b3-5f5254784bad","command-injection-in-github-actions-exposes-cicd-secrets-across-61-repositories","da3ef47a-6ae3-470f-9197-697607a1d8f1","Command Injection in GitHub Actions Exposes CI\u002FCD Secrets Across 61 Repositories","Attackers exploited a widespread misconfiguration in GitHub Actions workflows where user-controlled input—such as issue titles, pull request bodies, and comments—was passed directly into shell scripts without sanitization, enabling command injection. This campaign targeted 61 public repositories, demonstrating that insecure CI\u002FCD pipeline design is a systemic, not isolated, problem. The attack vector is particularly dangerous because CI\u002FCD environments often hold highly privileged secrets such as API keys, deployment credentials, and cloud access tokens. Compromising these secrets can cascade into full supply chain attacks, potentially affecting downstream users of the targeted software.","**Immediate actions:**\n- Audit all GitHub Actions workflow files to identify any steps that interpolate user-controlled input (e.g., `${{ github.event.issue.title }}`) directly into `run:` shell commands and replace them with safe environment variable assignments.\n- Rotate all CI\u002FCD secrets stored in GitHub repository or organization secrets that may have been exposed to vulnerable workflows.\n\n**Long-term improvements:**\n- Enforce a policy of using intermediate environment variables (e.g., `env:` blocks) to pass user-controlled data into shell steps, never direct expression interpolation.\n- Restrict GitHub Actions workflow trigger permissions by applying the `permissions:` key with least-privilege scopes, and require pull request approvals before workflows execute on external contributor code.\n- Implement secret scanning tools (e.g., GitHub Advanced Security, truffleHog) as mandatory pipeline gates to detect accidental or injected secret exposure.\n\n**Detection measures:**\n- Enable GitHub audit logs and ship them to a SIEM to alert on unexpected workflow runs, secret access events, or unusual pull request activity from external contributors.\n- Implement runtime monitoring of CI\u002FCD jobs to detect anomalous outbound network connections that may indicate secret exfiltration.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 16: Application Software Security":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":26},"NIS2 requires organizations to implement security measures covering incident handling and supply chain security; the targeting of software build pipelines to steal secrets directly threatens the integrity of the software supply chain that NIS2 mandates be protected.","Attackers used social-engineering-adjacent vectors—malicious issues, pull requests, and comments—as the delivery mechanism to trigger vulnerable workflows, paralleling phishing techniques that abuse trusted communication channels.","The vulnerable workflow patterns are documented and known; a structured process for identifying and remediating known-vulnerable code patterns in CI\u002FCD pipelines would have reduced exposure across all 61 repositories.","Command injection is a classic input validation failure; secure software development practices requiring sanitization of all user-controlled input before use in shell contexts would have blocked the attack vector.","Insecure use of GitHub Actions expression interpolation represents a misconfigured component in the build pipeline; treating pipeline dependencies and workflow patterns under a component security review would have flagged this risk.","The insecure interpolation pattern in GitHub Actions workflows is a documented technical vulnerability; a formal vulnerability management process covering CI\u002FCD infrastructure would have identified and remediated it before exploitation.","The root cause was an insecure default pattern in workflow configuration; enforcing secure-by-default pipeline templates and configuration standards would have prevented raw user input from reaching shell commands.","published","2026-11-02T05:20:45.903398+00:00","2026-11-02T05:20:45.891+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-target-61-github-repositories\u002F","hackers-target-61-github-repositories-with-command-injection-attacks-to-steal-ci-eca283","Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI\u002FCD Secrets",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]