CVE-2026-12567

Name of the Vulnerable Software and Affected Versions github workflows (affected versions not specified)

Description The github workflows module constructs local directory paths using repository names provided by the user without validating for symlinks. A local attacker with access to the scan directory can place a symlink at the predictable output path, which leads to workflow data being written to a location chosen by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.