github actions news
3 stories
Snowflake GitHub Actions Flaw Allows Command Injection
A recently disclosed vulnerability in Snowflake's GitHub Actions workflows could allow for command injection, according to researchers. The flaw, identified within the snowflakedb/snowflake-connector-net repository, reportedly enables the execution of arbitrary commands within a workflow through the submission of a specially crafted GitHub issue.
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
Recent reports indicate that researchers have uncovered critical vulnerabilities within Anthropic's Claude Code and Google's Gemini CLI tools. These flaws reportedly enabled unprivileged attackers to achieve code execution on Continuous Integration (CI) runners. The vulnerabilities have since been patched by the respective vendors and assigned CVE identifiers, though the specific CVEs were not…
The GitHub Actions Attack Pattern Your CI Security Scanners Miss
Researchers have identified a new class of vulnerabilities in Continuous Integration/Continuous Deployment (CI/CD) pipelines, dubbed "Cordyceps," which can be exploited by attackers with a free GitHub account. These weaknesses, disclosed by Novee Security, bypass traditional security scanning tools because they exploit the composition of workflow interactions rather than flaws within…