PPE — Poisoned Pipeline Execution
Poisoned Pipeline Execution (PPE) lets attackers run malicious code in a CI/CD system without direct access.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline legitsecurity.com
GitHub Actions workflow_run PE.
-
Living off the pipeline github.com
Inventory how development tools (typically CLIs), have lesser-known RCE-By-Design features.
-
PR sneaking github.com
Methods of sneaking malicious code into GitHub pull requests.
-
PPEE (puppy) mzrst.com
-
#redteam tip: want to discretely extract credentials from a CI/CD pipeline? twitter.com
Draft pull requests won't alert repository contributors, but will still trigger pipelines.
-
tcpreplay tcpreplay.appneta.com
CI/CD Attacks › Techniques > Initial Code Execution: “Poisoned Pipeline Execution (PPE) lets attackers run malicious code in a CI/CD system without direct access.”