Malicious code analysis: Abusing SAST (mis)configurations to hack CI systems
Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
10 real-world stories of how we've compromised CI/CD pipelines nccgroup.com
Examples include exploiting S3 misconfigurations, Jenkins plugin flaws, GitLab runner privilege escalations, Kubernetes pod annotation vulnerabilities, and compromised developer laptops.
-
The Monsters in Your Build Cache – GitHub Actions Cache Poisoning adnanthekhan.com
Allows attackers to compromise workflows even with limited permissions by exploiting vulnerabilities or dependency flaws, attackers steal cache tokens, fill the cache to force evictions, and replace legitimate entries with malicious code.
-
Hacking GitHub AWS integrations again dagrz.com
Attacking misconfigured pipelines that use OIDC.
-
Living off the pipeline github.com
Inventory how development tools (typically CLIs), have lesser-known RCE-By-Design features.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
-
PR sneaking github.com
Methods of sneaking malicious code into GitHub pull requests.
CI/CD Attacks › Techniques > Initial Code Execution: “Misconfigured SAST tools can be exploited to execute malicious code on CI systems, allowing attackers to steal credentials or deploy malicious artifacts.”