ByteDance Rspack

Figure 1: We observed that the “Release Canary” workflow was configured to run on issue comment and would execute if the issue comment contained the keyword “!canary”.

Compromising ByteDance’s Rspack using GitHub Actions Vulnerabilities

| | ByteDance Rspack, Vulnerability Research
Overview Recently, we identified several critical Pwn Request vulnerabilities within GitHub Actions used by the Rspack repository. These vulnerabilities could allow an external attacker to submit a malicious pull request, without the ...
Blog | Praetorian
Figure 1: We observed that the “Release Canary” workflow was configured to run on issue comment and would execute if the issue comment contained the keyword “!canary”.

Compromising ByteDance’s Rspack using GitHub Actions Vulnerabilities

| | ByteDance Rspack, Vulnerability Research
Recently, we identified several critical Pwn Request vulnerabilities within GitHub Actions used by the Rspack repository. These vulnerabilities could allow an external attacker to submit a malicious pull request, without the requirement ...
Security Blog | Praetorian