Tools

pvharmo2/gha-lab-3f1ff30e9c

Authorized security-research lab reproducing CVE-2026-31852 (jellyfin/jellyfin-ios pull_request_target pwn in code-quality.yml) — isolated snapshot,…

pvharmo2/gha-lab-61c59f4acb

Security-research lab: controlled reproduction of CVE-2026-33075 (pwn request in labring/FastGPT preview-image workflow, pull_request_target +…

pvharmo2/gha-lab-85f022290a

Research lab reproduction of CVE-2026-34243 (GHSA-r4fj-r33x-8v88): command injection via issue_comment.body in .github/workflows/comment.yaml —…

pvharmo2/gha-lab-9b5e3ccfbe

Security-research lab: reproduction of CVE-2026-33475 (GitHub Actions script injection via PR branch name in deploy-docs-draft.yml), snapshot of…

pvharmo2/gha-lab-ca4fa82ac5

Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit…

pvharmo2/gha-lab-ed7a1740c4

Security-research lab: controlled reproduction of GHSA-3g6g-gq4r-xjm9 / CVE-2026-35580 (GitHub Actions workflow_dispatch input shell injection)…

pvharmo2/gha-lab-fb6df3d456

Authorized security-research lab reproducing CVE-2025-46820 (GHSA-cwj7-6v67-2cm4): GITHUB_TOKEN persisted into publicly downloadable CI artifacts in…

pvharmo2/gha-lab-25b7988758

Authorized security-research reproduction of CVE-2026-27701 / GHSA-xh9w-5859-x97j (live-codes/livecodes @ 8017e01): untrusted PR title interpolated…

pvharmo2/gha-lab-b16a4f3554

Security-research lab: CVE-2026-24480 pull_request_target pre-commit RCE in qgis/QGIS (snapshot at vulnerable commit)

pvharmo2/gha-lab-7927d7d06f

Security-research lab reproducing CVE-2026-22869 (pwn) — arbitrary code execution in privileged pull_request_target run via npx local-bin hijack,…

pvharmo2/gha-lab-a7f6217d26

Security-research reproduction of CVE-2026-27938 / GHSA-4q9f-mjxf-rx7x (GitHub Actions expression injection in release workflows) — snapshot of…

pvharmo2/gha-lab-b5c1313658

Authorized security-research lab reproducing CVE-2026-1699 (pwn request in preview.yml) — snapshot of eclipse-theia/theia-website

pvharmo2/gha-lab-6926364d94

Security research lab reproducing CVE-2025-53546 (GHSA-h87r-5w74-qfm4): pull_request_target arbitrary code execution in RSSNext/Folo's auto-fix lint…

pvharmo2/gha-lab-2f775f277c

Authorized lab reproduction of CVE-2025-47928 (spotipy-dev/spotipy pull_request_target secrets exfiltration) — snapshot at vulnerable commit 4f5759d

pvharmo2/gha-lab-3b0a828a69

Security-research lab reproducing CVE-2025-53104 (GHSA-432r-9455-7f9x): command injection in discussion-to-slack.yml of gluestack/gluestack-ui

pvharmo2/gha-lab-f894926966

Authorized security-research reproduction lab for CVE-2025-54415 (GHSA-g5hx-xv45-9whg): astronomer/dag-factory snapshot at 464c75a —…

pvharmo2/gha-lab-6904b2ccbe

Security-research lab: reproduction of CVE-2025-61584 (GHSA-9g7x-737f-5xpc) — command injection via github.head_ref in pull_request_target workflow…