[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqUUPiafLLJR0VBxNUO4KKRWbqZHZhTR_-kDqwL0O8vM":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c156b410-2c97-4a79-9895-902cf719a644","Exploitable CI\u002FCD Vulnerabilities Expose Millions of Repositories to Hijacking","exploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking-0c4fd4","The security defects allow unauthenticated users to take control of the open source software supply chain. The post Exploitable CI\u002FCD Vulnerabilities Expose Millions of Repositories to Hijacking appeared first on SecurityWeek.","A new class of vulnerabilities, dubbed Cordyceps, has been discovered in CI\u002FCD workflows that could allow unauthenticated attackers to hijack developer workflows and gain full control over millions of open-source repositories. These flaws, found in GitHub Actions YAML files, can lead to command injection, artifact poisoning, and credential exfiltration, impacting build tooling from major vendors like Microsoft, Google, and Apache. Novee, the cybersecurity firm that identified the issues, warns that these vulnerabilities are often overlooked by traditional scanners because they exploit the composition of workflows rather than individual components.","CI\u002FCD vulnerabilities allow unauthenticated attackers to hijack developer workflows and control millions of","https:\u002F\u002Fwww.securityweek.com\u002Fexploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-06-24T10:55:05+00:00","2026-06-24T12:00:12.60215+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GitHub Actions","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":22},"Google",{"name":26,"type":22},"Apache",{"name":28,"type":22},"Cloudflare",{"name":30,"type":22},"Python Software Foundation","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":57,"vendors":137},[58,87,115],{"slug":59,"name":60,"problem":61,"products":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":88,"name":89,"problem":90,"products":91},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[92,99,107],{"vendor_slug":93,"vendor_name":24,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":116,"name":117,"problem":118,"products":119},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[120,128,129],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[138,143,145],{"slug":139,"name":28,"logo_path":140,"roles":141},"cloudflare","\u002Fvendor-logos\u002Fcloudflare.png",[142],"affected",{"slug":93,"name":24,"logo_path":94,"roles":144},[142],{"slug":146,"name":21,"logo_path":147,"roles":148},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[142],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":162},"cicd-workflow-flaws-enable-mass-repository-hijacking","CI\u002FCD Workflow Flaws Enable Mass Repository Hijacking","The Cordyceps vulnerabilities expose a critical blind spot in how organizations secure their software development pipelines: GitHub Actions YAML files can be composed in ways that introduce command injection, artifact poisoning, and credential exfiltration risks that traditional scanners miss entirely. Because these flaws emerge from the *interaction* between workflow components rather than any single vulnerable file, they evade conventional static analysis tools and remain undetected in millions of repositories. The downstream impact is severe — a compromised CI\u002FCD pipeline gives attackers a trusted insertion point into the software supply chain, potentially affecting every user of the resulting software artifacts. This highlights how misconfigured automation infrastructure, not just application code, has become a primary attack surface in modern development environments.",[154,155,156,157,158,159,160,161],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 16: Application Software Security","NIST SP 800-218 SSDF: PW.4 – Reuse Existing, Well-Secured Software","NIST SP 800-161 C-SCRM: Supply Chain Risk Management","NIST CSF DE.CM-3: Personnel activity is monitored","SLSA Supply Chain Levels for Software Artifacts (L2\u002FL3)","OpenSSF Scorecard: Token-Permissions, Pinned-Dependencies checks","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 (Insufficient Credential Hygiene), CICD-SEC-8 (Ungoverned Usage of 3rd Party Services)",{}]