CVE-2026-25761
📋 TL;DR
Super-linter GitHub Action versions 6.0.0 to 8.3.0 are vulnerable to command injection via specially crafted filenames containing shell command substitution syntax like $(...). This allows attackers to execute arbitrary commands in GitHub Actions workflow runners, potentially exposing sensitive data like GITHUB_TOKEN. Organizations using Super-linter in their CI/CD pipelines are affected.
💻 Affected Systems
- super-linter GitHub Action
📦 What is this software?
Super Linter by Super Linter Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of GitHub Actions runner environment, exfiltration of secrets and source code, lateral movement within GitHub organization, and persistence in CI/CD pipelines.
Likely Case
Unauthorized access to GITHUB_TOKEN with repository permissions, allowing code modification, secret disclosure, and workflow manipulation.
If Mitigated
Limited impact due to restricted GITHUB_TOKEN permissions, runner isolation, and proper security controls.
🎯 Exploit Status
Exploitation requires ability to submit pull requests to affected repositories. Public proof-of-concept exists in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.1
Vendor Advisory: https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x
Restart Required: No
Instructions:
1. Update super-linter action in workflow YAML files to v8.3.1 or later. 2. Replace 'uses: github/super-linter@v8' with 'uses: github/super-linter@v8.3.1'. 3. Commit and push changes to all affected repositories.
🔧 Temporary Workarounds
Pin to safe version
allManually specify super-linter version 8.3.1 or later in workflow files
uses: github/super-linter@v8.3.1
Disable super-linter
allTemporarily remove super-linter from workflows until patched
# Comment out or remove super-linter steps in .github/workflows/*.yml
🧯 If You Can't Patch
- Restrict GITHUB_TOKEN permissions to minimum required in workflow files
- Implement branch protection rules requiring review before pull request merge
🔍 How to Verify
Check if Vulnerable:
Check .github/workflows/*.yml files for super-linter references with versions between 6.0.0 and 8.3.0Check Version:
grep -r 'super-linter@' .github/workflows/Verify Fix Applied:
Confirm workflow files reference super-linter@v8.3.1 or later📡 Detection & Monitoring
Log Indicators:
- Unexpected command execution in GitHub Actions logs
- Suspicious filenames containing $(...) patterns in pull requests
Network Indicators:
- Unusual outbound connections from GitHub Actions runners
SIEM Query:
source="github-actions" AND (command_injection OR suspicious_filename OR unexpected_execution)