Security concern: CI could leak github secrets
#297 aberto em 30 de nov. de 2025
Métricas do repositório
- Stars
- (37 estrelas)
- Métricas de merge de PR
- (Mesclagem média 5d 12h) (16 fundiu PRs em 30d)
Description
I was recently watching a video about NPM's supply chain attack, and how its starting point was the exploitation of a github action. We may be vulnerable to a similar attack to on this repo by a willing malicious actor.
The culprit is on: pull_request_target. This is used in 2 places in our CI: testsuite_preview.yaml and labeler.yaml. The labeler workflow is probably safe (?), but the testsuite_preview is likely exploitable. See this article: https://shreyapohekar.com/blogs/how-attackers-exploit-pull_request_target-secure-your-github-ci-cd-workflows/ . We do exactly what we shouldn't do.
The purpose of that pull_request_target was to be able to have the workflow work for PRs sent from forks.
See also: https://www.wiz.io/blog/s1ngularity-supply-chain-attack
I recommend disabling the PR until a proper security analysis of the pipeline can be done. I unfortunately do not have the time to look into this myself, but please do look into this. I am concerned ☹️
Make sure to disable/remove/fix this CI from other branches as well, not just main.