“If an attacker removed and then added a v3 tag to their malicious commit, every single repository using the default CodeQL workflow would execute their malicious code,” explained the researcher in their report. A significant vulnerability in GitHub’s CodeQL actions could have permitted attackers to execute malicious code across hundreds of thousands of repositories. The compromised token had significant privileges, including “Contents: write,” “Actions: write,” and “Packages: write,” allowing for extensive repository manipulation. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. When users enable CodeQL in their repository settings, GitHub creates a workflow that executes actions from the github/codeql-action repository referenced by specific tags. The vulnerability, assigned CVE-2025-24362, originated from a publicly exposed GitHub token in workflow artifacts that created a small but exploitable window of opportunity. Similar to the recent tj-actions/changed-files incident, it demonstrates how seemingly minor issues in development tooling can cascade into significant security risks for the broader ecosystem. Kaaviya is a Security Editor and fellow reporter with Cyber Security News.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 27 Mar 2025 08:30:18 +0000