CVE-2026-25761
Command Injection in Super-linter GitHub Action Enables Code Execution
Publication date: 2026-02-09
Last updated on: 2026-02-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| super-linter_project | super-linter | From 6.0.0 (inc) to 8.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Super-linter GitHub Action versions from 6.0.0 to 8.3.0. It allows command injection through crafted filenames that contain shell command substitution syntax, such as $(...). When these specially crafted filenames are processed during file discovery, the embedded commands can be executed in the workflow runner context.
This happens because the runtime scripts in the affected versions do not properly sanitize filenames, leading to arbitrary command execution.
An attacker can exploit this by submitting a pull request with a malicious filename, causing commands to run when the Super-linter action processes the files.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary command execution within the GitHub Actions workflow runner environment.
An attacker exploiting this can potentially disclose sensitive information such as the job’s GITHUB_TOKEN, depending on the workflow's permission configuration.
This can result in unauthorized access, data leakage, or further compromise of the CI/CD pipeline and associated resources.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Super-linter GitHub Action to version 8.3.1 or later, where the issue is fixed.
Avoid using vulnerable versions (6.0.0 to 8.3.0) in your workflows to prevent command injection via crafted filenames.