🎯 New Report #3619287: RCE Supply Chain Attack via pull request target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers
🔺Severity: Critical
👽 Reporter: 6r1ff1n
⭐️ Reputation: 94
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-06-11 14:28:34
📝 Summary: A vulnerability was discovered in the DuckDuckGo content-scope-scripts repository's GitHub Actions workflow. The workflow used the pull request target trigger without access controls, allowing untrusted code from fork pull requests to be checked out and executed. This could have led to remote code execution and the potential exfiltration of sensitive information, such as API keys, on the runner. The vulnerability also could have been exploited to manipulate the automated release pipeline, potentially compromising all DuckDuckGo browsers and extensions across multiple platforms.
📂 Report JSON File: 3619287
@hackeronereports