[GHSA-5gfj-gw94-7c87] CodSpeed Github Actions Arbiratry Code Execution

advisories/unreviewed/2026/08/GHSA-5gfj-gw94-7c87.json

@@ -0,0 +1,57 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5gfj-gw94-7c87",
+  "modified": "2026-08-07T12:00:00Z",
+  "published": "2026-08-07T12:00:00Z",
+  "aliases": [],
+  "summary": "CodSpeed: GitHub Actions integration executes untrusted PR code automatically with network access",
+  "details": "A supply chain vulnerability exists in the standard integration pattern of CodSpeed within GitHub Actions workflows. By design, CodSpeed automates benchmarking execution on Pull Requests. However, because it runs automatically on pull request hooks without isolation boundaries or required human verification, an attacker can submit a malicious Pull Request containing arbitrary execution payloads. The runner automatically executes the code inside the CI/CD pipeline environment with outbound network access enabled, allowing data exfiltration, secret leakage, and runner resource abuse before any human code review takes place.\n\nThe reporter contacted the maintainers 150 days prior to this advisory with no response or resolution.\n\n## Proof of Exploit\nWhen CodSpeed runs its benchmark, a crafted malicious PR containing outbound requests (e.g., utilizing `urlopen`) can easily execute arbitrary payloads. The runner successfully connects outbound to attacker infrastructure and exfiltrates environment data.\n\n## Impact\n- **Secret leakage:** Environment variables, tokens, or API keys available on the runner can be stolen.\n- **Denial of service:** Malicious code (e.g., infinite loops) can stall workflows and block development.\n- **Resource abuse:** Attackers can hijack GitHub Actions compute for unauthorized background activities.\n- **Source code compromise:** Attackers can attempt to exfiltrate the default GitHub token to dump private repository contents if configured incorrectly.",
+  "severity": [
+     {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H"
+     }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "GitHub Actions",
+        "name": "CodSpeedHQ/action"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "credits": [
+    {
+      "name": "HackingRepo",
+      "contact": [
+        "https://github.com/HackingRepo"
+      ],
+      "type": "FINDER"
+    }
+  ],
+  "references": [
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/CodSpeedHQ/codspeed"
+    },
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-912"
+    ],
+    "severity":"HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}