Most recent entries from all

certfr-2025-avi-0622 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

2026-10-08T14:08:43.119546+00:00

certfr-2025-avi-0622

EUVD-2026-202485

2026-10-08T14:08:43.119593+00:00

EUVD-2026-202485

fkie_cve-2024-52587

2026-10-08T14:08:43.119609+00:00

StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.

GHSA-g85v-wf27-67xc — Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`

2026-10-08T14:08:43.119643+00:00

Affected: GitHub Actions: step-security/harden-runner

### Summary

Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time.

### Details

1. setup.ts:169 [1] performs `execSync` with a command that gets invoked after interpretation by the shell. This command includes an interpolated `process.env.USER` variable, which an attacker could modify (without actually creating a new user) to inject arbitrary shell expressions into this `execSync`. This may or may not be likely in practice, but I believe the hygienic way to perform the underlying operation is to use `execFileSync` or similar and bypass the underlying shell evaluation.

2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above, but with `$USER` for shell-level interpolation rather than string interpolation. However, this is still injectable and would be best replaced by an `execFileSync`, per above.

3. arc-runner:40-44 [3] has an `execSync` with multiple string interpolations. Most of these do not appear immediately injectible (since they appear to come from presumed trusted API responses), but the expansion of `getRunnerTempDir(…