CVE-2026-25761 in Super-linter
Summary
by MITRE • 02/09/2026
Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job’s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/28/2026
The vulnerability identified as CVE-2026-25761 affects Super-linter versions 6.0.0 through 8.3.0, representing a critical command injection flaw that can be exploited through crafted filenames in GitHub Actions workflows. Super-linter serves as a comprehensive linter solution that combines multiple linter tools to validate code quality and detect potential security issues. The vulnerability stems from insufficient input sanitization during the file discovery process where the linter fails to properly escape or validate filenames that contain shell metacharacters. This flaw allows attackers to inject malicious shell commands by creating files with names containing command substitution syntax such as $(...), which can then be executed during the linter's processing phase.
The technical implementation of this vulnerability leverages the inherent trust placed in file naming conventions within automated workflows. When Super-linter processes files during its runtime, it performs file discovery operations that may inadvertently execute shell commands embedded within filenames. This occurs because the linter's file handling routines do not adequately sanitize or escape special shell characters that could be interpreted by the shell during filename processing. The vulnerability specifically impacts the linter's ability to properly handle filenames that contain characters like $(), backticks, or other shell metacharacters that enable command substitution. This type of flaw maps directly to CWE-78, which describes improper neutralization of special elements used in shell commands, and aligns with ATT&CK technique T1059.001 for executing malicious commands through shell injection.
The operational impact of this vulnerability extends beyond simple command execution to potentially compromise the entire GitHub Actions workflow environment. When an attacker successfully exploits this vulnerability, they can execute arbitrary commands within the context of the workflow runner, which typically operates with elevated privileges and access to the repository's GITHUB_TOKEN. This token provides access to repository resources and can be used to perform unauthorized actions such as reading secrets, pushing code changes, or accessing sensitive data. The vulnerability is particularly dangerous in environments where workflows have broad permissions or where the GITHUB_TOKEN is used to access external systems. The attack vector requires an attacker to submit a pull request containing a file with maliciously crafted naming conventions, making it difficult to detect through traditional security measures. The exploitability is high due to the automated nature of GitHub Actions and the trust placed in linter tools within CI/CD pipelines.
Mitigation strategies for CVE-2026-25761 require immediate action to upgrade Super-linter to version 8.3.1 or later, which contains the necessary patches to prevent command injection through filename handling. Organizations should also implement additional security measures such as validating and sanitizing all filenames in CI/CD workflows, implementing least privilege access for workflow tokens, and monitoring pull requests for suspicious file naming patterns. Security teams should consider implementing automated scanning of repository contents for potential command injection patterns and establish proper input validation controls in all automated processes that handle user-supplied data. The fix implemented in version 8.3.1 addresses the core issue by ensuring proper shell escaping and filename validation during the linter's file discovery phase. This vulnerability highlights the importance of secure coding practices in automated tools and demonstrates how seemingly benign file handling operations can become security attack vectors when proper input validation is not implemented. The remediation process should include comprehensive testing to ensure that all file processing operations properly sanitize inputs and that no other similar injection vectors exist within the linter's codebase.