published Aug 27, 2026, 8:37 AM · updated Aug 27, 2026, 8:37 AM
Daily VulnHunter Scan
VulnHunter scan of github/gh-aw complete — no exploitable vulnerabilities confirmed.
Scope: the 40 pre-ranked files in scope/candidates.txt (Go CLI/compiler/parser packages plus the actions/setup .cjs runtime scripts). Applied phase2_class_inj.md (injection classes) and falsified every candidate with phase2b_verify.md. Notes written to /tmp/gh-aw/agent/vulnhunter/out/phase2b_output.md.
Result: 17 injection-class candidates raised, 0 survived falsification.
Representative eliminations (each cites the specific defense):
- git argument injection in the API-auth fallback paths (git archive / clone / checkout / ls-remote) — gated by gitutil.ValidateGitRef and ValidateGitPath before every exec, plus a "--" end-of-options separator (pkg/parser/remote_download_file.go:302-307,338,419-426; remote_resolve_sha.go:32).
- Token leakage via workflow import URLs — attachImportAuthHeader requires scheme https AND an exact host match against the GitHub allowlist before setting the bearer header (pkg/cli/import_url_fetcher.go:217,225); errors are URL-stripped by sanitizeHTTPError.
- Arbitrary Bash execution during operational-value regrade — the archived evaluator must match the manifest digest, the artifact digest, a shebang/UTF-8/size check, the local checkout repo, and byte-match
git showoutput at the trusted commit (pkg/cli/graders_operational_value_regrade.go:261-267,333-338,353-368). - Path traversal from artifact Content-Disposition — neutralized by path.basename() after decodeURIComponent (actions/setup/js/artifact_client.cjs:175).
- Container-scan option injection — buildRunnerGuardContainerScanPath enforces filepath.IsLocal, rejects control chars, and prefixes "./" (pkg/cli/runner_guard.go:41-53).
- Remote symlink resolution escaping the repo root — rejected when the cleaned path is empty, ".", absolute, or ".."-prefixed, with depth bounded by MaxSymlinkDepth (pkg/parser/remote_download_file.go:276-278,283-295).
The remaining candidates failed Gate 2a: their inputs (CLI flags such as --repo, workflow frontmatter in the operator's own checkout, GITHUB_REPOSITORY) originate from the trust principal already running the tool, so no new capability is gained.
Two non-security code-quality observations, deliberately not reported as vulnerabilities:
- sanitizeRepoPath (pkg/cli/update_command.go:418) strips "/ \ : @" but not ".", so a "." or ".." slug maps onto a parent directory. Not exploitable today because the slug is operator-supplied, but rejecting dot-only components would make the helper safe to reuse elsewhere.
- logs_parsing_javascript.go:128 and logs_parsing_firewall.go:117 build Node source by interpolating a filesystem path into a single-quoted JS literal. Both values are program-controlled (os.MkdirTemp results and fixed path segments), but passing them via cmd.Env or argv would remove the latent code-construction pattern.
No issue created: per VulnHunter reporting rules, only findings that survive falsification are reported, and none did.
Generated from Daily VulnHunter Scan · 362.4 AIC · ⌖ 51.9 AIC · ◇ 32 AIC · ⊞ 5.7K · ◷