CVE-2026-102289

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

GHSA-F42P-WJW5-97QH zizmor: Debug logging prints available GitHub credentials in cleartext

Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, or the corresponding command-line options --gh-token, --github-token, --zizmor-github-token are included in the...

zizmor: Debug logging prints available GitHub credentials in cleartext

Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, or the corresponding command-line options --gh-token, --github-token, --zizmor-github-token are included in the...

CVE-2026-102289

The static analysis tool zizmor version 1.27.0 contains a vulnerability where debug logging serializes the application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables (e.g., GH_TOKEN, GITHUB_TOKEN, ZIZM...

CVE-2026-102289 zizmor: Debug logging prints available GitHub credentials in cleartext

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

PT-2026-141142

Name of the Vulnerable Software and Affected Versions zizmor version 1.27.0 Description Debug logging serializes the parsed application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables GH TOKEN, GITHUB...

CVE-2026-102289: zizmorcore zizmor: zizmor is a static analysis tool for CI/CD systems

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

zizmor

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

zizmor v1.30.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: cargo-audit, tealdeer, wasm-pack, buck2, deno, shadowsocks-rust, xh, atuin, oranda, uv, wash, rustup, linkerd-extension-init, nushell, rye, zed, wadm, kdash, zizmor, zola, wasmcloud, lychee, parseable, sccache, pixi, samply, rustls-ffi, linkerd2-proxy, qdrant,...

zizmor v1.30.0-rc1

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

zizmor v1.29.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

GHSA-82J2-J2CH-GFR8 vulnerabilities

Vulnerabilities for packages: mise, wasmcloud, zizmor, shadowsocks-rust, deno, rustls-openssl-client, wasm-pack, xh, garage, pixi, sccache, linkerd2-cni-plugin, rustup, linkerd2, rye, linkerd-extension-init, tealdeer, komodo, kdash, vector, wasmtime, buck2, ntpd-rs, fnm, ztunnel-fips, ztunnel,...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: cargo-audit, tealdeer, wasm-pack, deno, buck2, linkerd2, shadowsocks-rust, xh, atuin, linkerd-network-validator, uv, rustup, linkerd-extension-init, zellij, rye, zed, kdash, zizmor, zola, wasmcloud, lychee, parseable, efs-utils, vector, pixi, samply, sccache, ztunnel...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: cargo-audit, tealdeer, wasm-pack, deno, buck2, linkerd2, shadowsocks-rust, xh, atuin, linkerd-network-validator, uv, rustup, linkerd-extension-init, zellij, rye, zed, kdash, zizmor, zola, wasmcloud, lychee, parseable, efs-utils, vector, pixi, samply, sccache, ztunnel...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: mise, wasmcloud, zizmor, shadowsocks-rust, deno, wasm-pack, xh, garage, pixi, sccache, linkerd2-cni-plugin, rustup, linkerd2, rye, linkerd-extension-init, tealdeer, komodo, kdash, vector, wasmtime, buck2, ntpd-rs, fnm, ztunnel-fips, ztunnel, linkerd2-proxy, zola, ber...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: mise, wasmcloud, zizmor, shadowsocks-rust, deno, wasm-pack, xh, garage, pixi, sccache, linkerd2-cni-plugin, rustup, linkerd2, rye, linkerd-extension-init, tealdeer, komodo, kdash, vector, wasmtime, buck2, ntpd-rs, fnm, ztunnel-fips, ztunnel, linkerd2-proxy, zola, ber...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: cargo-audit, buck2, deno, starship, ntpd-rs, linkerd2, shadowsocks-rust, rav1e, uutils, atuin, just, linkerd-network-validator, xh, yara-x, uv, rustup, zellij, nushell, rye, fish, mountpoint-s3, zed, wadm, kdash, zizmor, zola, mdbook, ruff, wasmcloud, lychee, hurl,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: jujutsu, mise, wasmcloud, mountpoint-s3, worktrunk, shadowsocks-rust, zizmor, deno, uutils, xh, garage, pixi, sccache, fish, rustup, sqlx, linkerd2, rye, netavark, bootc, cargo-c, watchexec, yara-x, guestproxyagent, apollo-router, kdash, komodo, mdbook, vector, wadm,...