Read the docs
TI-2022-18697 Aliases CVE-2022-39321GHSA-2c6m-6gqh-6qg3

GitHub Actions Runner vulnerable to Docker Command Escaping

Priority MEDIUM 47CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered in versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use container actions, job containers, or service containers alongside untrusted user inputs in environment variables may be vulnerable. The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers in versions 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4. GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions. As a workaround, users may consider removing any container actions, job containers, or service containers from their jobs until they are able to upgrade their runner versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0196 80th percentileScored 2026-11-07
Fix Fixed runner (actions): 2.283.4, 2.285.2, 2.289.4 +2actions/runner (GitHub Actions): 2.296.2, 2.293.1, 2.289.4 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
actionsrunnerbefore 2.283.4; 2.284.0 to before 2.285.2; 2.286.0 to before 2.289.4; 2.290.0 to before 2.293.1; 2.294.0 to before 2.296.22.283.4, 2.285.2, 2.289.4, 2.293.1, 2.296.2Patch availableCNA
—actions/runner (GitHub Actions)2.294.0 to before 2.296.22.296.2Patch availableGHSA-2c6m-6gqh-6qg3
—actions/runner (GitHub Actions)2.290.0 to before 2.293.12.293.1Patch availableGHSA-2c6m-6gqh-6qg3
—actions/runner (GitHub Actions)2.286.0 to before 2.289.42.289.4Patch availableGHSA-2c6m-6gqh-6qg3
—actions/runner (GitHub Actions)2.284.0 to before 2.285.22.285.2Patch availableGHSA-2c6m-6gqh-6qg3
—actions/runner (GitHub Actions)before 2.283.42.283.4Patch availableGHSA-2c6m-6gqh-6qg3
  • runner Vendoractions Affected before 2.283.4; 2.284.0 to before 2.285.2; 2.286.0 to before 2.289.4; 2.290.0 to before 2.293.1; 2.294.0 to before 2.296.2 Fixed in 2.283.4, 2.285.2, 2.289.4, 2.293.1, 2.296.2 Patch available CNA
  • actions/runner (GitHub Actions) Vendor— Affected 2.294.0 to before 2.296.2 Fixed in 2.296.2 Patch available GHSA-2c6m-6gqh-6qg3
  • actions/runner (GitHub Actions) Vendor— Affected 2.290.0 to before 2.293.1 Fixed in 2.293.1 Patch available GHSA-2c6m-6gqh-6qg3
  • actions/runner (GitHub Actions) Vendor— Affected 2.286.0 to before 2.289.4 Fixed in 2.289.4 Patch available GHSA-2c6m-6gqh-6qg3
  • actions/runner (GitHub Actions) Vendor— Affected 2.284.0 to before 2.285.2 Fixed in 2.285.2 Patch available GHSA-2c6m-6gqh-6qg3
  • actions/runner (GitHub Actions) Vendor— Affected before 2.283.4 Fixed in 2.283.4 Patch available GHSA-2c6m-6gqh-6qg3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:github:runner:*:*:*:*:*:*:*:*before 2.283.4; 2.284.0 to before 2.285.2; 2.286.0 to before 2.289.4; 2.290.0 to before 2.293.1; 2.294.0 to before 2.296.2VulnerableGitHub
  • cpe:2.3:a:github:runner:*:*:*:*:*:*:*:* Versions before 2.283.4; 2.284.0 to before 2.285.2; 2.286.0 to before 2.289.4; 2.290.0 to before 2.293.1; 2.294.0 to before 2.296.2 Vulnerable ·GitHub

Remediation

  • Fix · CNA runner (actions) Fixed in 2.283.4, 2.285.2, 2.289.4, 2.293.1, 2.296.2
  • Fix · GHSA-2c6m-6gqh-6qg3 actions/runner (GitHub Actions) Fixed in 2.296.2 Advisory →
  • Fix · GHSA-2c6m-6gqh-6qg3 actions/runner (GitHub Actions) Fixed in 2.293.1 Advisory →
  • Fix · GHSA-2c6m-6gqh-6qg3 actions/runner (GitHub Actions) Fixed in 2.289.4 Advisory →
  • Fix · GHSA-2c6m-6gqh-6qg3 actions/runner (GitHub Actions) Fixed in 2.285.2 Advisory →
  • Fix · GHSA-2c6m-6gqh-6qg3 actions/runner (GitHub Actions) Fixed in 2.283.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39321
  2. 2026-10-03 Alias added: GHSA-2c6m-6gqh-6qg3

References

Patch 2

Advisory 2

Other 1

  • TI-2025-05316 actions toolkit glob internal-pattern.ts globEscape redos CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences