Critical · published May 15, 2025
🚨 An untrusted pull request can execute malicious code with full access to your GitHub secrets! 🔥 Think of it like giving a stranger the keys to your house because they brought a pizza. You trust the delivery, but once they're inside, they can snoop around and grab anything they want! An attacker could exploit this vulnerability to exfiltrate crucial secrets like your `GITHUB_TOKEN`, which grants them full control over your repository. Imagine losing all that hard work because someone walked off with your keys—absolute devastation!
Think of it like giving a stranger the keys to your house because they brought a pizza. You trust the delivery, but once they're inside, they can snoop around and grab anything they want! The issue arises from the `pull_request_target` feature in GitHub Actions, allowing untrusted code execution with access to the base repository's secrets, making it a prime target for exploitation.
An attacker could exploit this vulnerability to exfiltrate crucial secrets like your `GITHUB_TOKEN`, which grants them full control over your repository. Imagine losing all that hard work because someone walked off with your keys—absolute devastation! Revert to commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f to eliminate the vulnerability. Review your GitHub Actions configurations to ensure sensitive secrets are only exposed to trusted code. Regularly audit your repository for untrusted PRs. You've got this! Secure your repo and keep those secrets safe! 🛡️