TLDR Tech / InfoSec
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub has updated its `actions/checkout` to prevent "pwn request" attacks by blocking automatic checkout of forked pull requests in `pull_request_target` and `workflow_run` workflows. This change addresses vulnerabilities where untrusted fork code could execute with elevated permissions, a method exploited in past campaigns. Developers are advised to limit `pull_request_target` use, favor `pull_request`, and restrict permissions in privileged workflows.
Read the full story