🎯Basically, a flaw let anyone run harmful code on Microsoft’s GitHub by just creating an issue.
What Happened
Microsoft recently addressed a critical vulnerability in its public GitHub repository, specifically the Windows-driver-samples. This flaw allowed any user with a GitHub account to execute remote code execution (RCE) by simply opening an issue on the repository. The vulnerability was reported by Tenable, who highlighted its severity in an advisory.
The Flaw
The issue stemmed from a GitHub Actions workflow that improperly handled the body of issues created in the repository. When a user submitted an issue, the content was inserted directly into a Python here-document without any sanitization. This oversight allowed attackers to use triple-quote string terminators to escape the string literal and inject malicious Python code.
Who's Affected
The vulnerability impacted the Windows-driver-samples repository, which has garnered about 7,700 stars and 5,000 forks on GitHub. While Microsoft did not disclose the specific permissions of the GITHUB_TOKEN that could be extracted, Tenable researchers noted that the default settings for tokens created before 2023 typically allowed for both read and write operations.
What Data Was Exposed
An attacker exploiting this vulnerability could have executed arbitrary Python code in the context of the GitHub runner. This could lead to the extraction of the GITHUB_TOKEN, which is a sensitive credential that could allow for issue creation on behalf of Microsoft. The potential for misuse was significant, given that exploitation was deemed trivial by Tenable, as anyone with a free registered GitHub account could have submitted a malicious issue.
Patch Status
The flaw was reported to Microsoft in February 2026 and was fixed on March 13, 2026. Microsoft’s prompt action mitigated the risk of exploitation, but the incident serves as a reminder of the importance of securing continuous integration and continuous delivery (CI/CD) pipelines.
Immediate Actions
Tenable emphasizes the need for organizations to audit their CI/CD workflows, particularly GitHub Actions, for vulnerabilities and misconfigurations. Reviewing permissions for sensitive tokens, like GITHUB_TOKEN, is crucial to prevent unnecessary access and potential exploitation. As noted by Tenable’s Rémy Marot, "The CI/CD infrastructure is part of an organization’s attack surface and software supply chain, requiring strict security controls to protect source code and build integrity."
🔒 Pro insight: This incident underscores the critical need for secure coding practices in CI/CD pipelines to prevent supply chain vulnerabilities.
