GitHub Security Lab (GHSL) Vulnerability Detection #

This document summarizes sisakulint’s detection capability against GitHub Security Lab advisories for the GitHub Actions ecosystem.

Summary #

Detection Categories #

Detection Results #

Code Injection Vulnerabilities #

Untrusted Code Execution Vulnerabilities #

TOCTOU / Approval Bypass Vulnerabilities #

Key Findings #

1. 100% Detection Rate: sisakulint successfully detects all 18 GHSL advisories for GitHub Actions workflows.

2. Code Injection Dominance: 13 of 18 advisories (72%) involve code injection vulnerabilities via untrusted input in shell commands.

3. Untrusted Checkout Patterns: 7 advisories involve checking out untrusted PR code in privileged contexts.

4. Cache/Supply Chain Risks: 6 advisories involve cache poisoning or supply chain attack vectors.

5. Privileged Trigger Exploitation: All advisories exploit privileged triggers (pull_request_target, issue_comment, workflow_run).

Core Detection Rules #

Taint Tracking #

sisakulint implements sophisticated taint tracking to detect indirect code injection:

1. Direct Context Tracking: Identifies untrusted GitHub context variables
2. Action Output Tracking: Tracks taint through known actions (e.g., xt0rted/pull-request-comment-branch)
3. Step Output Propagation: Follows taint through actions/github-script outputs

Running Verification #

# Build sisakulint
go build ./cmd/sisakulint

# Test all GHSL patterns
./sisakulint script/actions/ghsl/

# Test GHSL-2024 advisories
./sisakulint script/actions/ghsl/ghsl-2024-325-326.yaml
./sisakulint script/actions/ghsl/ghsl-2024-326-direct.yaml
./sisakulint script/actions/ghsl/ghsl-2024-326-known-action.yaml

# Test GHSL-2025 advisories
./sisakulint script/actions/ghsl/ghsl-2025-006.yaml   # homeassistant-powercalc
./sisakulint script/actions/ghsl/ghsl-2025-038.yaml   # branch-deploy TOCTOU
./sisakulint script/actions/ghsl/ghsl-2025-077.yaml   # beeware
./sisakulint script/actions/ghsl/ghsl-2025-082.yaml   # ag-grid
./sisakulint script/actions/ghsl/ghsl-2025-084.yaml   # datadog-actions-metrics
./sisakulint script/actions/ghsl/ghsl-2025-087.yaml   # PX4-Autopilot
./sisakulint script/actions/ghsl/ghsl-2025-089.yaml   # YDB
./sisakulint script/actions/ghsl/ghsl-2025-090.yaml   # harvester
./sisakulint script/actions/ghsl/ghsl-2025-091.yaml   # pymapdl
./sisakulint script/actions/ghsl/ghsl-2025-094.yaml   # faststream
./sisakulint script/actions/ghsl/ghsl-2025-099.yaml   # cross-platform-actions
./sisakulint script/actions/ghsl/ghsl-2025-101.yaml   # homeassistant-tapo-control
./sisakulint script/actions/ghsl/ghsl-2025-102.yaml   # acl-anthology (link-to-checklist)
./sisakulint script/actions/ghsl/ghsl-2025-103.yaml   # acl-anthology (print-info)
./sisakulint script/actions/ghsl/ghsl-2025-104.yaml   # weaviate
./sisakulint script/actions/ghsl/ghsl-2025-105.yaml   # vets-api
./sisakulint script/actions/ghsl/ghsl-2025-106.yaml   # esphome-docs
./sisakulint script/actions/ghsl/ghsl-2025-111.yaml   # nrwl/nx

Common Vulnerability Patterns #

Privileged Triggers #

These triggers grant elevated permissions and are prime targets for attacks:

Untrusted Inputs #

Common untrusted inputs that can be exploited:

github.event.pull_request.head.ref
github.event.pull_request.title
github.event.pull_request.body
github.event.issue.title
github.event.issue.body
github.event.comment.body
github.event.workflow_run.head_branch
github.event.workflow_run.head_repository.full_name
steps.*.outputs.* (from tainted actions)

References #

• GitHub Security Lab Advisories
• Keeping your GitHub Actions and workflows secure
• OWASP CI/CD Top 10 Security Risks
• GitHub Actions Security Hardening