GitHub Actions
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by Cyber Security NewsHackers target 61 GitHub repositories with command injection to steal CI/CD secrets
Recent news
Guide urges pinning GitHub Actions to commit SHAs to block supply chain attacks
The article is part one of a series on hardening GitHub Actions against outside attackers. It explains that version tags such as @v4 are movable pointers, and cites the March 2025 tj-actions/changed-files compromise, where repointed tags exposed credentials in public build logs. It recommends pinning actions to full 40-character commit SHAs, enforcing this with zizmor and an organisation policy, and warns that a SHA proves immutability but not provenance.
Hackers target 61 GitHub repositories with command injection to steal CI/CD secrets
Radware observed 83 malicious issues, pull requests and comments across 61 public GitHub repositories on 1 September 2026, with injected commands executing in two GitHub Actions workflows. The workflows inserted user-controlled titles into Bash shell scripts, so $() substitutions ran, and the payload dumped environment variables, Base64-encoded them and attempted an HTTP POST. Radware did not confirm stolen secrets, repository write access or compromised releases, and some participating accounts may have been hijacked.