chore(deps): update super-linter/super-linter action to v8 [security]#376
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update super-linter/super-linter action to v8 [security]#376renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
renovate
bot
requested review from
jpetto and
kschelonka
and removed request for
a team
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6.0.0→v8.3.1GitHub Vulnerability Alerts
CVE-2026-25761
Summary
The Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as
$(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job’sGITHUB_TOKENdepending on how the workflow configures permissions.Details
The issue appears originates in the logic that scans the repository for changed files to check.
pull_requestevents.$GITHUB_TOKEN.Impact
GITHUB_TOKEN.The level of exposure depends on the source of the pull request.
To actively exploit the vulnerability, an attacker needs have the ability to run workflows without any approval from the repository admin.
Also, the
GITHUB_TOKENneeds to have unconstrained access to repository resources. Even in that case, for pull request coming from forked repositories, no secrets are passed to the forked repository when running workflows triggered bypull_requestevents, and theGITHUB_TOKENdrops and write permission on the source repository source.Finally, although not specific to this vulnerability, we recommend auditing
workflow_callandpull_request_targetworkflows because they can lead to compromise, regardless of whether you're using Super-linter, or not, as explained by this GitHub Enterprise doc.Release Notes
super-linter/super-linter (super-linter/super-linter)
v8.3.1Compare Source
🐛 Bugfixes
⬆️ Dependency updates
🧰 Maintenance
v8.3.0Compare Source
🚀 Features
🐛 Bugfixes
⬆️ Dependency updates
🧰 Maintenance
v8.2.1Compare Source
🐛 Bugfixes
⬆️ Dependency updates
🧰 Maintenance
v8.2.0Compare Source
🚀 Features
🐛 Bugfixes
⬆️ Dependency updates
🧰 Maintenance
v8.1.0Compare Source
🚀 Features
⬆️ Dependency updates
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.