{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/zizmorcore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zizmorcore:zizmor:1.27.0:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102289"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zizmor (1.27.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["zizmorcore"],"content_html":"\u003cp\u003eVersion 1.27.0 of the zizmor security tool contains a vulnerability (CVE-2026-102289) where GitHub credentials are logged to stderr in cleartext when the application is run with debug-level logging enabled. The issue arises from a derived \u003ccode\u003eDebug\u003c/code\u003e implementation on internal CLI configuration types, which causes tokens provided via environment variables (\u003ccode\u003eGH_TOKEN\u003c/code\u003e, \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e, \u003ccode\u003eZIZMOR_GITHUB_TOKEN\u003c/code\u003e) or command-line flags to be printed during runtime initialization. The vulnerability is triggered by the \u003ccode\u003e-v\u003c/code\u003e or \u003ccode\u003e--verbose\u003c/code\u003e flags. While GitHub maintains automated secret scanning and redaction in some contexts, the credentials remain at risk if the stderr output is captured, saved to CI artifacts, or pasted into public support channels.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact is contingent on the scope and permissions associated with the leaked GitHub token. An unauthorized party with access to the disclosed logs could potentially leverage the token to read private repositories, modify workflows, or access organization resources depending on the specific token privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate zizmor to a version newer than 1.27.0 immediately.\u003c/li\u003e\n\u003cli\u003eRotate any GitHub tokens that may have been included in logs generated by zizmor 1.27.0 while running with \u003ccode\u003e--verbose\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit CI/CD pipeline artifacts and internal bug tracking systems for instances of zizmor verbose output to ensure no tokens were inadvertently persisted.\u003c/li\u003e\n\u003cli\u003eImplement local log masking for CI/CD runners if debug-level logging is required for operational troubleshooting.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T04:17:13Z","date_published":"2026-11-10T04:17:13Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zizmor-token-exposure/","summary":"zizmor version 1.27.0 exposes GitHub access tokens in cleartext within stderr when debug-level logging is enabled, risking credential theft through shared CI logs or bug reports.","title":"zizmor: GitHub credential exposure in debug logs (CVE-2026-102289)","url":"https://feed.craftedsignal.io/briefs/2026-11-zizmor-token-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Zizmorcore","version":"https://jsonfeed.org/version/1.1"}