Repository navigation
The Pwn Request Reckoning What Still Works Against GitHub Ac... - #525
Merged
carlospolop merged 2 commits intoNov 9, 2026
Conversation
Collaborator
Author
|
Decision: keep GitHub’s checkout changelog supports the protected events, version limits, alternative fetch paths, and opt-out behavior. GitHub’s artifact-action documentation supports the cross-run token and run-ID inputs and confirms the file-permission error in the example. The generic artifact-poisoning chain was already covered; the retained addition is the official downloader detail, not a claim th… Head: |
Collaborator
Author
|
merge |
carlospolop
deleted the
update_The_Pwn_Request_Reckoning_What_Still_Works_Again_efa72c0e87a6fbbd
branch
November 9, 2026 21:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Blog URL
https://wiz.io/blog/github-actions-security-pwn-request-reckoning
Blog Title
The Pwn Request Reckoning: What Still Works Against GitHub Actions
Blog high summary
Audits residual GitHub Actions pwn-request risk after the 2026 hardening.
pull_request_targetremains exploitable through pre-backport SHA-pinnedactions/checkout,allow-unsafe-pr-checkout, customgit/ghcheckout, untrusted shell interpolation, and privileged triggers whose inputs select code or commands. Impact includes runner command execution and secret/token exposure. (wiz.io)Covers artifact poisoning through
workflow_run, persistent state on non-ephemeral self-hosted runners, approval-setting gaps, exact checkout-version minimums, the December 2, 2026 public-repository policy, and copy-paste grep/SHA-resolution audits using Wiz Code orzizmor. (wiz.io)PR changes
Errors
mdbook build unavailable