CVE-2026-102289

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

CVE-2026-102289

The static analysis tool zizmor version 1.27.0 contains a vulnerability where debug logging serializes the application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables (e.g., GH_TOKEN, GITHUB_TOKEN, ZIZM...

CVE-2026-102289: zizmorcore zizmor: zizmor is a static analysis tool for CI/CD systems

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...