POC

[rossnoah]

No description provided.

[github-actions]

Proof of concept — pull_request_target RCE

This comment was posted from a fork PR via the lint-commit.yml workflow:

1. The workflow uses on: pull_request_target and checks out the fork-controlled PR head SHA.
2. It then runs yarn add ..., which invokes scripts.preinstall from the checked-out package.json before validating arguments or contacting the registry.
3. A malicious scripts.preinstall runs arbitrary code on the runner.
4. GITHUB_TOKEN is recovered from the step wrapper script in /home/runner/work/_temp and used to authenticate this comment.

The payload is benign. Recommended fix: change the trigger from pull_request_target to pull_request — commit-message linting does not require write-scoped access to the base repository.

[oddlama]

Thank you very much! I've applied a fix to the workflow on main