CVE-2026-102289

Name of the Vulnerable Software and Affected Versions zizmor version 1.27.0

Description Debug logging serializes the parsed application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables GH TOKEN, GITHUB TOKEN, ZIZMOR GITHUB TOKEN, or command-line options --gh-token, --github-token, and --zizmor-github-token. The affected logging is triggered by using the -v or --verbose options or an applicable RUST LOG directive during normal online operation or when using --no-online-audits. If an unauthorized party gains access to CI logs, support artifacts, terminal captures, or public bug reports containing this output, they can use the credentials based on the token's scopes and permissions.

Recommendations Update zizmor to version 1.28.0. As a temporary workaround, avoid using the -v or --verbose options and the RUST LOG directive when providing GitHub credentials.