38% of GitHub Actions Workflows Vulnerable to Script Injection

Severity: Medium (Score: 51.9)

Sources: Gbhackers, securitylabs.datadoghq.com

Published: 2026-06-04 · Updated: 2026-06-04

Keywords: github, actions, workflows, script, injection, case, security

Summary

Analysis shows that 38% of organizations using GitHub Actions workflows are exposed to script injection and unsafe trigger configurations. This vulnerability poses a significant risk in software supply chains, as GitHub Actions automate critical development tasks. The findings indicate that two out of three organizations have at least one vulnerability in their workflows or actions. Misconfigured workflows can serve as high-privilege entry points for attackers, allowing them to manipulate code, leak credentials, or compromise software. The report emphasizes the importance of securing workflows, especially given their role in managing credentials and automating deployments. The vulnerabilities stem from common practices like using third-party actions and broad permissions for the default GITHUB_TOKEN. Organizations are urged to assess their GitHub Actions configurations to mitigate these risks. Key Points: • 38% of organizations face vulnerabilities in GitHub Actions workflows. • Misconfigured workflows can lead to credential leaks and compromised software. • Two out of three organizations have at least one vulnerability in their GitHub Actions.

Detailed Analysis

**Impact** 38% of organizations worldwide have GitHub Actions workflows vulnerable to script injection or unsafe trigger configurations, affecting a broad range of sectors that rely on automated software development pipelines. These vulnerabilities expose critical build and deployment processes, potentially allowing attackers to execute arbitrary code, leak credentials, and compromise software supply chains. The issue impacts any organization using GitHub Actions for CI/CD, with no geographic limitations specified. **Technical Details** The primary attack vector involves exploiting misconfigured GitHub Actions workflows, particularly the misuse of the `pull_request_target` trigger, which grants elevated permissions and access to secrets. Attackers inject malicious scripts into workflows to execute arbitrary code during build or deployment stages, gaining high-privilege access within the software supply chain. No specific CVEs or malware names were provided. The kill chain stage targeted is primarily the execution and persistence phases within CI/CD pipelines. **Recommended Response** Organizations should audit GitHub Actions workflows to identify and remediate unsafe triggers, especially replacing `pull_request_target` with safer alternatives where possible. Restrict permissions of the default `GITHUB_TOKEN` and avoid running workflows on untrusted pull requests. Implement strict validation of third-party actions and monitor workflow execution logs for anomalous activity. No patches were specified; continuous monitoring of workflow configurations and access controls is critical.

Source articles (2)

• 38% of GitHub Actions Workflows Exposed to Script Injection Risks — Gbhackers · 2026-06-03
  Analysis has revealed that 38% of organizations are running GitHub Actions workflows vulnerable to script injection or unsafe trigger configurations, highlighting a growing risk in modern software sup…
• Case For Github Actions Security — securitylabs.datadoghq.com · 2026-06-04
  GitHub Actions has been a major topic of discussion recently, playing a large role in multiple attacks. Three of the highest-profile examples each exploited a different class of vulnerability: In Febr…

Timeline

• 2026-06-03 — Gbhackers article on GitHub Actions vulnerabilities: An article highlighted the risks associated with GitHub Actions workflows, confirming the 38% vulnerability statistic.
• 2026-06-04 — GitHub Actions security report published: A report revealed that 38% of organizations have workflows vulnerable to script injection and unsafe configurations.

Related entities

• Supply Chain Attack (Attack Type)
• Hackerbot-claw (Campaign)
• S1ngularity Breach (Campaign)
• DataDog (Company)
• Nx (Company)
• kics.in (Domain)
• Amazon S3 (Platform)
• Azure Data Explorer (Platform)
• Azure Event Hub (Platform)
• GitHub Marketplace (Platform)
• GitHub Actions (Tool)
• KICS (Tool)
• Trivy (Tool)