Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

newrelic/docs-website

              develop @ bc78509
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.

.github/workflows/netlify-build-forked-pr.yml: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Checking out and running code from untrusted fork PRs inside a privileged workflow context allows external contributors to execute arbitrary code with repository secrets access. The fix replaced actions/checkout with safe GitHub API calls.

Credential Leak: Default behavior of actions/checkout persists runner credentials in the local git directory, exposing sensitive tokens to any subsequent, potentially untrusted build steps inside the workflow.

Information Disclosure: The use of deprecated stdout-based workflow command syntax (::set-output) can allow malicious output injection during workflow execution, leading to unintended state manipulation or information disclosure.