A newly identified vulnerability, named GitLost, has been discovered that allows for the exfiltration of private data from GitHub's Agentic Workflows. The flaw enables an unauthenticated attacker to exploit a public GitHub Issue to silently steal information from private repositories.
The exploit leverages a specific mechanism within GitHub Agentic Workflows. These workflows are designed to automate tasks and can be configured to access and process data from repositories. The GitLost vulnerability exploits how these workflows handle certain types of input or commands, particularly when interacting with external resources or generating output.
By creating a specially crafted public GitHub Issue, an attacker can trigger a workflow in a targeted private repository. This crafted issue contains malicious payloads that, when processed by the workflow, instruct it to send sensitive data back to an attacker-controlled endpoint. The exfiltration occurs silently, meaning the user or administrator of the private repository would not receive any immediate notification of the data leak.
The nature of the data that can be exfiltrated is not explicitly detailed, but it is understood to be any information accessible by the Agentic Workflow within the private repository. This could include source code, configuration files, sensitive credentials inadvertently stored in the repository, or any other data the workflow is permitted to access.
The vulnerability specifically targets GitHub Agentic Workflows, which are a feature designed to enhance automation and integrate with various tools and services. The attack vector relies on the workflow's execution context and its ability to interact with external systems or generate output that can be intercepted.
The fact that the attacker does not need to be authenticated to the target repository is a significant aspect of this vulnerability. This means that anyone who can create a public GitHub Issue could potentially attempt to exploit this flaw against private repositories they do not have legitimate access to.
While the specific technical details of the payload and the exact workflow configurations that are vulnerable are not fully disclosed, the core mechanism involves tricking the workflow into processing malicious input disguised as a legitimate issue comment or creation. This input then causes the workflow to inadvertently leak data.
As a general security measure, organizations using GitHub Agentic Workflows should review their workflow configurations and ensure that they are not inadvertently exposing sensitive information. Best practices include minimizing the scope of permissions granted to workflows, avoiding the storage of sensitive secrets directly within repositories, and regularly auditing workflow activity for any unusual patterns. Further guidance from GitHub on mitigating this specific vulnerability is expected.
