Search

Find a vulnerability

Search criteria

    2 vulnerabilities by zizmorcore

    CVE-2026-102289 (GCVE-0-2026-102289)

    Vulnerability from nvd – Published: 2026-11-09 21:37 – Updated: 2026-11-14 02:21
    VLAI
    Title
    zizmor: Debug logging prints available GitHub credentials in cleartext
    Summary
    zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-14 02:21 UTC
    CWE
    • CWE-532 - Insertion of Sensitive Information into Log File
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    zizmorcore zizmor Affected: = 1.27.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102289",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-14T02:21:35.770247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-14T02:21:57.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zizmor",
          "vendor": "zizmorcore",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:37:32.457Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2213",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2213"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2215"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f42p-wjw5-97qh",
        "discovery": "UNKNOWN"
      },
      "title": "zizmor: Debug logging prints available GitHub credentials in cleartext"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102289",
    "datePublished": "2026-11-09T21:37:32.457Z",
    "dateReserved": "2026-09-28T20:11:16.659Z",
    "dateUpdated": "2026-11-14T02:21:57.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-102289 (GCVE-0-2026-102289)

    Vulnerability from cvelistv5 – Published: 2026-11-09 21:37 – Updated: 2026-11-14 02:21
    VLAI
    Title
    zizmor: Debug logging prints available GitHub credentials in cleartext
    Summary
    zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.
    Severity
    7 (High)
    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-14 02:21 UTC
    CWE
    • CWE-532 - Insertion of Sensitive Information into Log File
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    zizmorcore zizmor Affected: = 1.27.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102289",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-14T02:21:35.770247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-14T02:21:57.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zizmor",
          "vendor": "zizmorcore",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.27.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T21:37:32.457Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2213",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2213"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/pull/2215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/pull/2215"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"
        },
        {
          "name": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f42p-wjw5-97qh",
        "discovery": "UNKNOWN"
      },
      "title": "zizmor: Debug logging prints available GitHub credentials in cleartext"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102289",
    "datePublished": "2026-11-09T21:37:32.457Z",
    "dateReserved": "2026-09-28T20:11:16.659Z",
    "dateUpdated": "2026-11-14T02:21:57.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}