Vulnerability-Lookup

CVE-2026-25761 (GCVE-0-2026-25761)

Vulnerability from cvelistv5 – Published: 2026-02-09 20:27 – Updated: 2026-02-10 15:59

Title

Command injection via crafted filenames in Super-linter Action

Summary

Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job’s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/super-linter/super-linter/secu…	x_refsource_CONFIRM
	https://github.com/super-linter/super-linter/rele…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	super-linter	super-linter	Affected: >= 6.0.0, < 8.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T15:32:07.659920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T15:59:33.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "super-linter",
          "vendor": "super-linter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 8.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job\u2019s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T20:27:01.887Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x"
        },
        {
          "name": "https://github.com/super-linter/super-linter/releases/tag/v8.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/super-linter/super-linter/releases/tag/v8.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r79c-pqj3-577x",
        "discovery": "UNKNOWN"
      },
      "title": "Command injection via crafted filenames in Super-linter Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25761",
    "datePublished": "2026-02-09T20:27:01.887Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-10T15:59:33.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25761\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-09T21:15:49.323\",\"lastModified\":\"2026-02-09T21:55:30.093\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job\u2019s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"references\":[{\"url\":\"https://github.com/super-linter/super-linter/releases/tag/v8.3.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-25761\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-10T15:32:07.659920Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-10T15:32:08.337Z\"}}], \"cna\": {\"title\": \"Command injection via crafted filenames in Super-linter Action\", \"source\": {\"advisory\": \"GHSA-r79c-pqj3-577x\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"super-linter\", \"product\": \"super-linter\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 8.3.1\"}]}], \"references\": [{\"url\": \"https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x\", \"name\": \"https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/super-linter/super-linter/releases/tag/v8.3.1\", \"name\": \"https://github.com/super-linter/super-linter/releases/tag/v8.3.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job\\u2019s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-02-09T20:27:01.887Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-25761\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-10T15:59:33.745Z\", \"dateReserved\": \"2026-02-05T18:35:52.358Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-02-09T20:27:01.887Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-25761

Vulnerability from fkie_nvd - Published: 2026-02-09 21:15 - Updated: 2026-02-09 21:55

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/super-linter/super-linter/releases/tag/v8.3.1
	security-advisories@github.com	https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job\u2019s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1."
    }
  ],
  "id": "CVE-2026-25761",
  "lastModified": "2026-02-09T21:55:30.093",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-09T21:15:49.323",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/super-linter/super-linter/releases/tag/v8.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-R79C-PQJ3-577X

Vulnerability from github – Published: 2026-02-09 17:46 – Updated: 2026-02-09 22:39

Summary

Super-linter is vulnerable to command injection via crafted filenames in Super-linter Action

Details

Summary

The Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job’s GITHUB_TOKEN depending on how the workflow configures permissions.

Details

The issue appears originates in the logic that scans the repository for changed files to check.

Use a workflow that runs Super-linter on pull_request events.
Open a pull request that adds a new file with a crafted filename containing command substitution and an outbound request that includes $GITHUB_TOKEN.
Run the workflow.

Impact

Arbitrary command execution in the context of the workflow run that invokes Super-linter (triggered by attacker-controlled filenames in a PR).
Credential exposure / misuse: the injected command can read environment variables available to the action, including GITHUB_TOKEN.

The level of exposure depends on the source of the pull request.

To actively exploit the vulnerability, an attacker needs have the ability to run workflows without any approval from the repository admin.

Also, the GITHUB_TOKEN needs to have unconstrained access to repository resources. Even in that case, for pull request coming from forked repositories, no secrets are passed to the forked repository when running workflows triggered by pull_request events, and the GITHUB_TOKEN drops and write permission on the source repository source.

Finally, although not specific to this vulnerability, we recommend auditing workflow_call and pull_request_target workflows because they can lead to compromise, regardless of whether you're using Super-linter, or not, as explained by this GitHub Enterprise doc.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "super-linter/super-linter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "8.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "super-linter/super-linter/slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "8.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-09T17:46:31Z",
    "nvd_published_at": "2026-02-09T21:15:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe Super-linter GitHub Action is vulnerable to **command injection via crafted filenames**. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose **name** contains shell command substitution syntax, such as `$(...)`. In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job\u2019s `GITHUB_TOKEN` depending on how the workflow configures permissions.\n\n### Details\n\nThe issue appears originates in the logic that scans the repository for changed files to check.\n\n1. Use a workflow that runs Super-linter on `pull_request` events.\n2. Open a pull request that adds a new file with a crafted filename containing command substitution and an outbound request that includes `$GITHUB_TOKEN`.\n3. Run the workflow.  \n\n### Impact\n\n- **Arbitrary command execution** in the context of the workflow run that invokes Super-linter (triggered by attacker-controlled filenames in a PR).\n- **Credential exposure / misuse:** the injected command can read environment variables available to the action, including `GITHUB_TOKEN`.\n\nThe level of exposure depends on the source of the pull request.\n\nTo actively exploit the vulnerability, an attacker needs have the ability to run workflows without any [approval from the repository admin](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/approve-runs-from-forks).\n\nAlso, the `GITHUB_TOKEN` needs to have unconstrained access to repository resources. Even in that case, for pull request coming from forked repositories, no secrets are passed to the forked repository when running workflows triggered by `pull_request` events, and the `GITHUB_TOKEN` drops and write permission on the source repository [source](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflows-in-forked-repositories).\n\nFinally, although not specific to this vulnerability, we recommend auditing `workflow_call` and `pull_request_target` workflows because they can lead to compromise, regardless of whether you\u0027re using Super-linter, or not, as [explained by this GitHub Enterprise doc](https://docs.github.com/en/enterprise-cloud@latest/actions/reference/security/secure-use#mitigating-the-risks-of-untrusted-code-checkout).",
  "id": "GHSA-r79c-pqj3-577x",
  "modified": "2026-02-09T22:39:39Z",
  "published": "2026-02-09T17:46:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/super-linter/super-linter/security/advisories/GHSA-r79c-pqj3-577x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25761"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/super-linter/super-linter"
    },
    {
      "type": "WEB",
      "url": "https://github.com/super-linter/super-linter/releases/tag/v8.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Super-linter is vulnerable to command injection via crafted filenames in Super-linter Action"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-25761 (GCVE-0-2026-25761)

FKIE_CVE-2026-25761

GHSA-R79C-PQJ3-577X

Summary

Details

Impact

Tags

Sightings

Nomenclature