CVE-2026-25589: GitHub Actions Script Injection via Workflow Inputs
Can GitHub Actions be exploited for code execution?
A script injection vulnerability class affecting GitHub Actions workflows that interpolate untrusted user inputs (PR titles, issue bodies) directly into run steps. Attackers can execute arbitrary code in the CI/CD runner context.
Impact & Exploitation
Affects thousands of open-source and enterprise repositories. Enables secret exfiltration, supply chain tampering, and code signing key theft from CI/CD pipelines.
Precogs Research
This vulnerability intelligence report was analyzed and enriched by the Precogs AI Security Team. Our researchers continuously monitor emerging threats across AI code, LLM pipelines, and binary architectures to ensure accurate real-time remediation guidance.