ruattd/cve-2026-31431GitHub Actions workflow to test if the runner is vulnerable to CVE-2026-31431, confirming root privileges in a controlled environment.
This repository contains a workflow file for GitHub Actions to test whether the action runner is affected by CVE-2026-31431.
You can do the test by yourself, just create a repository by this template and trigger the test.yml workflow manually (remember to change the on field to your test target).
Yes, I've run it on the official runner based on ubuntu-latest image at 2026/4/30 10:43 (UTC+8).
The result:
Output received: uid=0(root) gid=1001(runner) groups=1001(runner),4(adm),100(users),118(docker),999(systemd-journal)
Success: Confirmed root privileges.
GitHub knows what you're doing, and if you do something you shouldn't, there's a high chance you'll be held accountable.