4 ms·
The vulnerability was not in the source code of the repo. See https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection https://blog.yossarian.net/2024
by smarx007 2y ago
The vulnerability was not in the source code of the repo. See https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-inj... for a deeper analysis - a great read!
- lostmsu 2y agoIt was. The vulnerability is the use of `pull_request_target` on a workflow that has access to secrets.
- smarx007 2y agoYou are right, my choice of words was poor. The vuln is exactly as you describe, and it's the malicious payload that was not in the codebase (cache poisoning which is not detectable by reviewing the code of the repo).