Critical RCE Vulnerability in Microsoft GitHub Repository Disclosed

A critical flaw in Microsoft's Windows-driver-samples GitHub repository allowed for remote code execution (RCE) via issue submissions. The vulnerability, identified by Tenable, enabled attackers to inject arbitrary Python code into a GitHub Actions workflow due to unsanitized input. This could lead to the exfiltration of the GITHUB_TOKEN secret, potentially allowing unauthorized actions on behalf of Microsoft. The flaw was assigned a CVSS score of 9.3, indicating a high severity. Microsoft patched the vulnerability on March 13, 2026, after it was reported in February 2026. The incident underscores the need for stringent security measures in CI/CD pipelines and proper management of sensitive tokens. The repository has significant visibility with 7,700 stars and 5,000 forks, increasing the potential impact of exploitation. Tenable also referenced a related incident involving OpenAI, highlighting ongoing risks in software supply chains.

Key Points: • A critical RCE vulnerability in a Microsoft GitHub repository was discovered and patched. • Attackers could exploit the flaw by submitting malicious issues, executing arbitrary Python code. • The vulnerability had a CVSS score of 9.3, indicating high severity and potential for significant impact.