tag
Ci-Cd
TeamCity — Unauthenticated RCE via Agent Polling Deserialization (CVE-2026-63077)
CVE-2026-63077 is an unauthenticated remote code execution vulnerability in JetBrains TeamCity. The agent polling subsystem accepts XML payloads from unregistered agents and deserializes them with XStream without any authentication or sanitization. An…
tj-actions/branch-names GitHub Actions Command Injection (CVE-2025-54416)
CVE-2025-54416 is a command injection vulnerability in tj-actions/branch-names, a popular GitHub Action used to extract branch/tag names into workflow outputs, affecting over 5,000 public repositories. The root cause is the action's internal use of eval…
Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417
The AWS CDK NodejsFunction construct bundles Lambda handlers with esbuild during cdk synth, and prior to 2.245.0 it built the esbuild invocation by directly interpolating several user/construct-controlled properties (externalModules, loader, define, inject,…
Sherlock CI `pull_request_target` Command Injection → GitHub Actions Secret Exfiltration (CVE-2026-44590)
The validatemodifiedtargets.yml GitHub Actions workflow in sherlock-project/sherlock uses the dangerous pullrequesttarget trigger and processes attacker-controlled pull request data (a JSON entry key) in a shell context without sanitization, resulting in…
psf/black GitHub Action RCE via Insecure Regex Version Validation — CVE-2026-31900
The psf/black GitHub Action's usepyproject: true option reads the Black version to install from the repository's pyproject.toml. The regex used to validate that version string (^black([^A-Z0-9.\-]+.)$ with re.IGNORECASE) is overly permissive, allowing…
HashiCorp go-getter Git Pathspec Arbitrary File Read (CVE-2026-4660)
go-getter resolves Terraform/Nomad/Packer/Waypoint module sources with ref query parameters passed straight through to git checkout. An attacker can publish a module whose ref is set to a git option such as --pathspec-from-file=/path/to/file instead of a real…
Gitea act_runner container.options Host Namespace Escape
Gitea's actrunner allows workflow YAML to append Docker options via jobs.<job>.container.options. When the runner configuration disables privileged mode, actrunner forces Privileged back to false and sanitizes bind mounts, but it preserves every other Docker…