Skip to content

H3-2025-0008

GitHub Actions Imposter Commit

Category SECURITY_CONTROLS
Base Score 6.0

Description

GitHub Actions workflows that fetch code from repositories without a tag or branch reference may inadvertently fetch commits from a malicious fork rather than the parent repository. This unapproved code may be malicious.

Impact

An attacker may exploit this weakness to obtain remote code execution in the context of the GitHub Actions workflow.

References