Advisoriesby IbisSafe-output artifacts may expose CI trigger tokens
gh-aw versions 0.83.3 through 0.85.3 generated workflows whose safe-output jobs captured raw process stdout and stderr in the safe-outputs-items artifact.
When a workflow configured with GH_AW_CI_TRIGGER_TOKEN executed the create-pull-request or push-to-pull-request-branch safe output, a credential-bearing git config command could be written to stdout. The resulting artifact contained a Base64-encoded Git authorization header. Because the output was saved before GitHub Actions runner masking occurred, normal secret masking did not protect the artifact.
Anyone able to download an affected artifact could decode the authorization header and recover the CI trigger token.
Exposure requires:
- A non-empty
GH_AW_CI_TRIGGER_TOKEN. - Execution of an affected create or push safe-output path.
- Access to the resulting workflow artifact.
Impact depends on the token’s permissions, lifetime, and repository scope. Staged, cross-repository, or skipped safe-output paths are not affected.
Remediation
Upgrade to gh-aw v0.85.4 or later, run gh aw upgrade, and commit all regenerated .lock.yml files. Upgrading the locally installed CLI without regenerating the workflows does not replace their SHA-pinned action references.
For any affected workflow run:
- Delete the corresponding
safe-outputs-itemsartifact. - Revoke and rotate any long-lived PAT supplied through...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gh-aw Product | >= 0.83.3, < 0.85.4 | 0.85.4 |
Details and references
gh-aw versions 0.83.3 through 0.85.3 generated workflows whose safe-output jobs captured raw process stdout and stderr in the safe-outputs-items artifact. When a workflow configured with `GH_AW_CI_TRIGGER_TOKEN` executed the `create-pull-request` or `push-to-pull-request-branch` safe output, a credential-bearing git config command could be written to stdout. The resulting artifact contained a Base64-encoded Git authorization header. Because the output was saved before GitHub Actions runner masking occurred, normal secret masking did not protect the artifact. Anyone able to download an affected artifact could decode the authorization header and recover the CI trigger token. Exposure requires: - A non-empty `GH_AW_CI_TRIGGER_TOKEN`. - Execution of an affected create or push safe-output path. - Access to the resulting workflow artifact. Impact depends on the token’s permissions, lifetime, and repository scope. Staged, cross-repository, or skipped safe-output paths are not affected. ## Remediation Upgrade to gh-aw v0.85.4 or later, run `gh aw upgrade`, and commit all regenerated `.lock.yml` files. Upgrading the locally installed CLI without regenerating the workflows does not replace their SHA-pinned action references. For any affected workflow run: - Delete the corresponding `safe-outputs-items` artifact. - Revoke and rotate any long-lived PAT supplied through `GH_AW_CI_TRIGGER_TOKEN` or `github-token-for-extra-empty-commit`. - Audit repository activity performed using that credential. - Confirm that any short-lived GitHub App installation token or `GITHUB_TOKEN` has expired or been revoked. Treat a long-lived credential as exposed if an affected artifact was available for download. Deleting the artifact does not invalidate copies that may already have been downloaded. ## References - [Fix credential-bearing Git output](https://github.com/github/gh-aw/pull/50636) - [Remove raw process logs from artifacts](https://github.com/github/gh-aw/pull/50739) - [Release v0.85.4](https://github.com/github/gh-aw/releases/tag/v0.85.4) - [Public report](https://github.com/github/gh-aw/issues/50616)
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532