CVE-2026-25761: Super-linter Command Injection Vulnerability

CVE-2026-25761 Overview

CVE-2026-25761 is a command injection vulnerability affecting Super-linter, a popular combination of multiple linters designed to run as a GitHub Action or standalone tool. The vulnerability exists in versions 6.0.0 through 8.3.0 and allows attackers to execute arbitrary commands through crafted filenames containing shell command substitution syntax.

When Super-linter is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). During file discovery processing, runtime scripts may execute the embedded command, enabling arbitrary command execution in the workflow runner context. This can be leveraged to disclose sensitive information including the job's GITHUB_TOKEN, depending on how the workflow configures permissions.

Critical Impact

Attackers can achieve arbitrary command execution in GitHub Actions workflow runners through malicious pull requests, potentially exposing repository secrets and the GITHUB_TOKEN.

Affected Products

• Super-linter versions 6.0.0 through 8.3.0
• GitHub Actions workflows using affected Super-linter versions
• CI/CD pipelines integrating vulnerable Super-linter releases

Discovery Timeline

• 2026-02-09 - CVE-2026-25761 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25761

Vulnerability Analysis

This command injection vulnerability (CWE-77) occurs when Super-linter processes filenames during its file discovery phase. The root issue stems from improper handling of user-controlled input—specifically filenames—that are passed to shell commands without adequate sanitization.

The vulnerability is exploitable over the network through the GitHub pull request mechanism. An attacker with no special privileges can craft a malicious pull request containing files with specially crafted names. The attack does require user interaction, as a maintainer or automated system must trigger the workflow that uses Super-linter.

When exploited, this vulnerability can lead to complete compromise of confidentiality, integrity, and availability within the workflow runner context. The attacker can execute arbitrary commands, potentially accessing repository secrets, modifying code, or disrupting CI/CD operations.

Root Cause

The vulnerability originates from insufficient input validation and sanitization in Super-linter's file discovery scripts. When processing filenames, the runtime scripts fail to properly escape or sanitize special shell characters. Filenames containing shell metacharacters like $(...) or backticks are interpreted as command substitution rather than literal strings, leading to unintended command execution.

Attack Vector

The attack vector leverages GitHub's pull request functionality as the entry point. An attacker creates a fork of a target repository, adds a file with a malicious filename such as $(malicious_command) or using backtick command substitution, and submits a pull request. When the repository's CI/CD workflow runs Super-linter on the pull request, the file discovery process encounters the malicious filename and inadvertently executes the embedded command.

The attacker can craft filenames to exfiltrate sensitive data, including the GITHUB_TOKEN, workflow secrets, or other environment variables. This access can then be used for lateral movement, supply chain attacks, or further compromise of the repository and its dependencies.

Detection Methods for CVE-2026-25761

Indicators of Compromise

• Unusual files in pull requests with filenames containing shell metacharacters like $(), backticks, or semicolons
• Unexpected network connections or DNS queries originating from GitHub Actions runners
• Anomalous workflow run times or resource consumption during Super-linter execution
• Evidence of secret exfiltration attempts in workflow logs or external monitoring systems

Detection Strategies

• Implement filename validation in pre-receive hooks or CI/CD pipelines to flag files with suspicious shell characters
• Monitor GitHub Actions workflow logs for unexpected command execution patterns or error messages
• Review pull requests for files with unusual naming conventions that may indicate exploitation attempts
• Deploy security scanning tools that detect command injection patterns in CI/CD configurations

Monitoring Recommendations

• Enable detailed logging for GitHub Actions workflows to capture file processing activities
• Set up alerts for workflows using Super-linter versions between 6.0.0 and 8.3.0
• Monitor for pull requests from untrusted contributors containing files with special characters in names
• Implement workflow permissions auditing to ensure minimal GITHUB_TOKEN scope

How to Mitigate CVE-2026-25761

Immediate Actions Required

• Upgrade Super-linter to version 8.3.1 or later immediately
• Review recent pull requests for potentially malicious filenames containing shell metacharacters
• Audit GitHub Actions workflow permissions to ensure minimal token privileges
• Temporarily disable Super-linter in workflows if immediate upgrade is not possible

Patch Information

The vulnerability has been fixed in Super-linter version 8.3.1. Organizations should update their GitHub Actions workflows to reference the patched version. For detailed information about the fix, refer to the GitHub Super-linter Release v8.3.1 and the GitHub Security Advisory GHSA-r79c-pqj3-577x.

Workarounds

• Pin Super-linter to a version prior to 6.0.0 if upgrade to 8.3.1 is not immediately feasible
• Implement repository rules to automatically flag or block pull requests containing files with shell metacharacters in names
• Configure workflow permissions to use read-only GITHUB_TOKEN with minimal scopes
• Add pre-processing validation steps to sanitize or reject files with suspicious naming patterns before Super-linter execution

# Update Super-linter in GitHub Actions workflow
# In your .github/workflows/*.yml files, update the uses directive:
uses: super-linter/super-linter@v8.3.1

# Or use a version constraint that includes the fix:
uses: super-linter/super-linter@v8