zizmor is a static analysis tool for GitHub Actions.
It can find many common security issues in typical GitHub Actions CI/CD setups, including:
- Template injection vulnerabilities, leading to attacker-controlled code execution
- Accidental credential persistence and leakage
- Excessive permission scopes and credential grants to runners
- Impostor commits and confusable git references
- ...and much more!
v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.
Many thanks to @shaanmajid for finding and reporting this vulnerability.
Enhancements 🌱🔗
The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)
The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)
sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)
Bug Fixes 🐛🔗
Fixed a bug where the template-injection audit would incorrectly flag steps..outcome and steps..conclusion as injection risks in the default persona (#2199)
Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)
Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)
