GitHub Actions Hardens Checkout Security to Block ‘Pwn Request’ Attacks
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.4 Articles
4 Articles
Security at GitHub Actions has gained new protection with an important update in the actions/checkout, one of the most used tools in automation workflows. The change was created to prevent a technique known as Pwn Request, which can allow malicious code sent by external collaborators to be executed within environments with high permissions. With the growth of attacks against the software supply chain, IC/CD pipelines have become one of the main …
CSO Online
InfoWorldGitHub Actions hardens checkout security to block ‘pwn request’ attacks
Stung by a surge in cyberattacks that have run amok in developer environments, GitHub has strengthened the security of actions/checkout to block ‘pwn request’ attacks that exploit insecure use of the pull_request_target workflow trigger to run an attacker’s code with the workflow’s full privileges. Announced on June 18, actions/checkout v7 now automatically blocks and fails workflows when used inside pull_request_target or workflow_run events wh…
GitHub Actions Checkout Update Blocks Workflows Triggered by Malicious pull_request_target
GitHub has rolled out a significant security enhancement to GitHub Actions by updating actions/checkout to block unsafe workflows that abuse the pull_request_target event. The pull_request_target trigger is widely known as one of the most misused events because it runs with the base repository’s GITHUB_TOKEN, secrets, and default-branch cache access, even when the pull request comes from an untrusted fork. When maintainers check out the head or …
Coverage Details
Bias Distribution
- There is no tracked Bias information for the sources covering this story.
Factuality
To view factuality data please Upgrade to Premium
