Cordyceps Flaw Class Hands Attackers the Keys to 300+ GitHub Repos

Researchers at Novee Security have named a new class of CI/CD workflow weakness Cordyceps, and the disclosure list reads like a who's-who of the open-source world.

Microsoft. Google. Apache. More than 300 repositories at some of the largest organizations on the planet are affected, according to the disclosure.

The pattern is not a single CVE. It's a structural flaw in how GitHub Actions and similar pipelines hand trust to inputs that attackers can manipulate — pull request titles, branch names, issue bodies, untrusted forks. When a workflow consumes that input without sanitization and runs with privileged tokens, an attacker can execute arbitrary code inside the pipeline and walk away with repository write access or secrets.

That's the cordyceps analogy. The fungus takes the host's body. The attacker takes the repo.

Novee describes Cordyceps as a "critical exploitable pattern" rather than a single bug, which matters for triage. Each affected project needs its own fix. There is no central patch.

The abuse path is familiar to anyone who has tracked supply-chain incidents over the past two years. Compromise a maintainer's pipeline, push a poisoned commit or release artifact, and the malicious payload ships downstream to every consumer of that package. The 2024 XZ Utils backdoor showed how patient an attacker can be. Cordyceps lowers the patience requirement considerably.

Neither Novee nor the affected projects have published, at time of writing, a full list of the 300-plus repositories. Coordinated disclosure is ongoing. GitHub's own guidance on securing workflows against script injection lives here, and remains the baseline reference for maintainers auditing their own pipelines.

What to check, if you run Actions workflows:

• Any step that interpolates ${{ github.event.* }} values directly into a run: block. That's the canonical injection sink.
• pull_request_target triggers combined with checkout of untrusted code. This combination has burned multiple high-profile projects already.
• Workflow permissions left at the default write-all instead of scoped down per job.
• Third-party Actions pinned by tag rather than commit SHA.

The broader picture is uncomfortable. CI/CD systems were built for developer convenience, then quietly became the most privileged execution environment in most organizations. They hold cloud credentials, signing keys and production deploy rights. Treating them as build tooling rather than crown-jewel infrastructure is how supply-chain compromises keep happening.

Novee says it is working with affected vendors on remediation. Expect a steady drip of project-level advisories rather than a single coordinated patch day.

Maintainers who suspect exposure should rotate any secrets accessible to their Actions runners before auditing the workflows themselves. Rotate first. Investigate second.