Over 250,000 Potential Security Issues Uncovered in GitHub Actions Workflows

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization. If that organization has given the agent read access across its repositories, private ones

'GitLost' vulnerability let GitHub's AI workflows leak private repositories

Researchers at artificial intelligence security company Noma Security Inc. today disclosed a critical prompt injection vulnerability in GitHub Inc.’s new Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code repositories by posting a single crafted issue in a public one. Named GitLost, the vulnerability was found by Noma Labs, the […] The post ‘GitLost’ vulnerability let GitHub’s AI workflows leak pr…

Kaspersky Finds Widespread GitHub Actions Flaws

Kaspersky’s Global Research and Analysis Team (GReAT) has identified widespread security misconfigurations in GitHub Actions workflows after analysing more than... Source

Over 250,000 Potential Security Issues Uncovered in GitHub Actions Workflows

Kaspersky’s Global Research and Analysis Team has conducted a major review of the GitHub Actions workflows within top-starred repositories. Leveraging newly introduced Kaspersky Container Security capability, the researchers have discovered 8 repositories with critical misconfigurations that could lead to supply chain compromise. Open-source components are now indispensable to modern software engineering. However, they also introduce hidden vect…

GitHub Actions workflows house potential security issues

Kaspersky’s Global Research and Analysis Team (GReAT) has conducted a major review of the GitHub Actions workflows within top-starred repositories. Leveraging newly introduced Kaspersky Container Security capability, the researchers have discovered 8 repositories with critical misconfigurations that could lead to supply chain compromise. Open-source components are now indispensable to modern software engineering. However, they also introduce hid…