The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree
A novel GitHub Actions worm exploits the action dependency tree. Attackers compromise an action, then infect dependent actions via branch pushes or tag overwrites, spreading malware recursively.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows paloaltonetworks.com
GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.
-
Bypassing required reviews using GitHub Actions medium.com
GitHub Actions can bypass required reviews, allowing malicious code pushes to protected branches.
-
The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2) wiz.io
Vulnerabilities in AI-powered GitHub Actions. Syntactical permission checks that let attackers impersonate trusted apps and Dependabot Deputy Confusion Injection.
-
Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline legitsecurity.com
GitHub Actions workflow_run PE.
-
One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images adnanthekhan.com
A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.
-
What the fork? Imposter commits in GitHub Actions and CI/CD chainguard.dev
GitHub Actions vulnerability allows forked commits to bypass workflow security settings.
CI/CD Attacks › Techniques > Post Exploitation: “A novel GitHub Actions worm exploits the action dependency tree. Attackers compromise an action, then infect dependent actions via branch pushes or tag overwrites, spreading malware recursively.”