CVE-2026-102289 | BDVDB-2026-402178 Detail
zizmorcorezizmor
Description#
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.
Impact#
Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: local.
Weaknesses#
- CWE-532 Insertion of Sensitive Information into Log File
References#
- https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh
- https://github.com/zizmorcore/zizmor/pull/2213
- https://github.com/zizmorcore/zizmor/pull/2215
- https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f
- https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f
- https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.