https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:23:42 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/euvd-2026-202485 EUVD-2026-202485 https://cve.radiocsirt.org/vuln/euvd-2026-202485 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52587 <p>StepSecurity&#39;s Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.</p> <p>StepSecurity&#39;s Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52587 https://cve.radiocsirt.org/vuln/ghsa-g85v-wf27-67xc <p><strong>Affected:</strong> GitHub Actions: step-security/harden-runner</p> <p>### Summary</p> <p>Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time.</p> <p>### Details</p> <p>1. setup.ts:169 [1] performs `execSync` with a command that gets invoked after interpretation by the shell. This command includes an interpolated `process.env.USER` variable, which an attacker could modify (without actually creating a new user) to inject arbitrary shell expressions into this `execSync`. This may or may not be likely in practice, but I believe the hygienic way to perform the underlying operation is to use `execFileSync` or similar and bypass the underlying shell evaluation.</p> <p>2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above, but with `$USER` for shell-level interpolation rather than string interpolation. However, this is still injectable and would be best replaced by an `execFileSync`, per above.</p> <p>3. arc-runner:40-44 [3] has an `execSync` with multiple string interpolations. Most of these do not appear immediately injectible (since they appear to come from presumed trusted API responses), but the expansion of `getRunnerTempDir(…</p> <p><strong>Affected:</strong> GitHub Actions: step-security/harden-runner</p> <p>### Summary</p> <p>Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time.</p> <p>### Details</p> <p>1. setup.ts:169 [1] performs `execSync` with a command that gets invoked after interpretation by the shell. This command includes an interpolated `process.env.USER` variable, which an attacker could modify (without actually creating a new user) to inject arbitrary shell expressions into this `execSync`. This may or may not be likely in practice, but I believe the hygienic way to perform the underlying operation is to use `execFileSync` or similar and bypass the underlying shell evaluation.</p> <p>2. setup.ts:229 [2] has a nearly identical `execSync` to (1) above, but with `$USER` for shell-level interpolation rather than string interpolation. However, this is still injectable and would be best replaced by an `execFileSync`, per above.</p> <p>3. arc-runner:40-44 [3] has an `execSync` with multiple string interpolations. Most of these do not appear immediately injectible (since they appear to come from presumed trusted API responses), but the expansion of `getRunnerTempDir(…</p> https://cve.radiocsirt.org/vuln/ghsa-g85v-wf27-67xc