Coordinated GitHub Actions campaign: 83 malicious issues hit 61 public repos via hidden HTML-comment payloads
Radware researchers Gabi Nakibly and Zvika Babo uncovered a coordinated campaign that abused GitHub issues, pull requests and comments to inject commands into vulnerable GitHub Actions workflows across 61 public repositories and 83 malicious items. Targets include high-profile open source projects such as google/langextract, aquasecurity/trivy, brave/brave-browser, mlflow/mlflow, cilium/cilium, ToolJet, agno-agi/agno, CopilotKit, Homebrew/homebrew-cask and PX4-Autopilot. 77 of the payloads were published during a 43-minute window on September 1, with six more in the following two minutes, using 74 different GitHub accounts — many with legitimate histories, suggesting compromise. The suspected goal was credential and token theft from CI/CD environments to enable a downstream supply chain attack. Researchers confirmed two cases where the malicious command executed inside the automation environment, but could not confirm repo write access or code modification.
Entenda a falha
A vulnerabilidade
This is a script-injection weakness in GitHub Actions workflows, with no CVE. It affects public repositories whose workflows are triggered by issues, pull requests or comments and insert that content directly into shell source code. The attacker needs only a GitHub account and no repository access, and the workflow must be configured to react to the event. A vulnerable workflow runs the attacker's hidden command and leaks environment variables, such as credentials and tokens. No product versions are given. Radware counted 83 malicious items across 61 repositories, including trivy, langextract, mlflow and brave-browser.
Como funciona
The attacker publishes an issue, pull request or comment with commands hidden in HTML comments, so nothing suspicious shows in the rendered page. A GitHub event automatically starts the associated workflow within about a second. If the workflow places the attacker-controlled text directly into shell source code, the shell runs the hidden command. That command collects the environment variables and tries to send them to a server the attacker controls.
Por que é vulnerável
The root cause is that vulnerable workflows treat external, attacker-controlled content as trusted and interpolate it into shell code instead of handling it as plain data. Secrets and environment variables are also exposed to workflows that external events can trigger. The articles describe no product fix. The researchers advise least-privilege permissions, separating externally triggered workflows from jobs with elevated permissions, treating external content as untrusted and limiting the secrets available to workflows.
Como foi descoberta
Radware researchers Gabi Nakibly and Zvika Babo found the campaign while investigating prompt injection in GitHub. They suspect a single individual is behind it. Most of the payloads (77) were published in a 43-minute window on September 1, and six more followed within two minutes, from 74 GitHub accounts, many with legitimate histories and therefore likely compromised. As of October 13 they had verified 83 items across 61 repositories. They found evidence in logs that the command ran in the automation environment in two cases, but cannot say whether the attacker obtained write access or changed code. They notified the maintainers, and most repositories were closed or fixed, though not all are confirmed. The Register published the findings on October 29 after an exclusive interview.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 10:15.
Detalhes técnicos
The attacker posts an issue, PR or comment containing commands hidden inside HTML comments, so they are invisible in the rendered page. A GitHub event automatically triggers the associated workflow within a second; if the workflow interpolates attacker-controlled content directly into shell source code, the hidden command executes, collecting environment variables and exfiltrating them to an attacker-controlled server. No repository access is required — any GitHub account can attempt the attack.
Remediação
Apply least-privilege to CI/CD workflows, separate externally triggered workflows from jobs with elevated permissions, treat all external content as untrusted, and minimize the secrets and environment variables exposed to workflows. Maintainers of affected repos were notified and most issues were closed or fixed.
Linha do tempo
-
Coordinated GitHub Actions campaign: 83 malicious issues hit 61 public repos via hidden HTML-comment payloads
ler a análise desta fonte ocultar
Radware researchers Gabi Nakibly and Zvika Babo uncovered a coordinated campaign that abused GitHub issues, pull requests and comments to inject commands into vulnerable GitHub Actions workflows across 61 public repositories and 83 malicious items. Targets include high-profile open source projects such as google/langextract, aquasecurity/trivy, brave/brave-browser, mlflow/mlflow, cilium/cilium, ToolJet, agno-agi/agno, CopilotKit, Homebrew/homebrew-cask and PX4-Autopilot. 77 of the payloads were published during a 43-minute window on September 1, with six more in the following two minutes, using 74 different GitHub accounts — many with legitimate histories, suggesting compromise. The suspected goal was credential and token theft from CI/CD environments to enable a downstream supply chain attack. Researchers confirmed two cases where the malicious command executed inside the automation environment, but could not confirm repo write access or code modification.
Technical Details
The attacker posts an issue, PR or comment containing commands hidden inside HTML comments, so they are invisible in the rendered page. A GitHub event automatically triggers the associated workflow within a second; if the workflow interpolates attacker-controlled content directly into shell source code, the hidden command executes, collecting environment variables and exfiltrating them to an attacker-controlled server. No repository access is required — any GitHub account can attempt the attack.
Remediation
Apply least-privilege to CI/CD workflows, separate externally triggered workflows from jobs with elevated permissions, treat all external content as untrusted, and minimize the secrets and environment variables exposed to workflows. Maintainers of affected repos were notified and most issues were closed or fixed.