-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper use of execSync with untrusted environment variables in shell commands. In setup.ts, lines 169 and 229 directly interpolate USER into shell commands without sanitization. In arc-runner.ts, multiple functions (sendAllowedEndpoints, applyPolicy, etc.) use execSync with getRunnerTempDir(), which relies on the RUNNER_TEMP environment variable. Attackers could manipulate these variables to inject arbitrary commands. The commit diff shows these were patched by replacing execSync with safer methods like execFileSync or Node.js filesystem APIs, confirming the vulnerable functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| step-security/harden-runner | actions | < 2.10.2 | 2.10.2 |
A Semantic Attack on Google Gemini - Read the Latest Research