🎯 Pwn Request

The items that name it 19

• The Pwn Request Reckoning: What Still Works Against GitHub Actions
  articleas classification.key entities2026-10-26
• Spectrmachina/Ztrust
  repoas classification.key entities2026-10-22
• PWN Request Threat: A Hidden Danger in GitHub Actions | Endor Labs
  articleas classification.key entities2026-10-16
• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas classification.key entities2026-10-12
• Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
  articleas techniques2026-09-30

  A CI/CD attack pattern where a pull request (or even a comment) triggers a workflow that runs an outsider's code with access to the project's secrets, potentially allowing credential theft and tampered releases.

• Workflow execution protections in GitHub Actions generally available - GitHub Changelog
  articleas classification.key entities2026-09-17
• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
  articleas techniques2026-09-16It is written here as pwn request (pull_request_target).

  Technique chained with cache poisoning in the TanStack attack to gain elevated workflow permissions

• GHSL-2026-203: Same-second TOCTOU in jupyterlab/maintainer-tools
  advisoryas techniques2026-09-04

  Class of attack referenced via linked resource 'Preventing pwn requests', where privileged workflows execute untrusted pull-request-controlled code.

• Shai-Hulud was the best thing to happen to supply chain security
  articleas techniques2026-08-24

  Malicious pull request exploiting vulnerable pull_request_target GitHub Actions workflows to execute attacker code inside the upstream repo's trusted context, used in S1ngularity and Shai-Hulud 2.0

• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas classification.key entities2026-08-13
• The OpenSourceMalware Show #15
  talkas techniques2026-07-31It is written here as Pwn Request (pull_request_target / workflow_run trigger abuse).

  High-risk GitHub Actions triggers that run in the context of the originating repository, exploited to push malware into CI/CD pipelines instead of stealing credentials.

• From Container Escape to Cloud Takeover
  writeupas classification.key entities2026-07-26
• The OpenSourceMalware Show #13
  talkas classification.key entities2026-07-16
• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
  writeupas techniques2026-07-14

  Vulnerability class in GitHub Actions where a workflow uses pull_request_target (running with base repo secrets) but checks out and executes attacker-controlled PR code, exposing secrets.

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  articleas techniques2026-06-22It is written here as Pwn request (pull_request_target abuse).

  Combining pull_request_target (which runs with base repository's GITHUB_TOKEN, secrets, cache access, runner environment) with checkout of untrusted fork PR code, allowing attacker-controlled code to run with the workflow's full privileges

• Socket: Mini Shai-Hulud
  articleas classification.key entities2026-05-22
• GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
  articleas techniques2026-04-14

  Attack class combining pull_request_target trigger with checking out PR head code, allowing attacker-controlled code to execute with base repository secrets and write permissions

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas techniques

  Attack pattern detected by StepSecurity GitHub Checks on pull requests.

• Securely using pull_request_target - GitHub Enterprise Cloud Docs
  articleas techniques

  Attack pattern where a workflow triggered by an event with elevated trust (e.g. pull_request_target, issue_comment, workflow_run) checks out or downloads and executes untrusted code (e.g. a fork's Makefile, build script, test command, dependency, or config file), allowing the attacker's code to run