Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.
Summary
StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| step-security | harden-runner | before 2.10.2 | 2.10.2 | Patch available | CNA |
| — | step-security/harden-runner (GitHub Actions) | before 2.10.2 | 2.10.2 | Patch available | GHSA-g85v-wf27-67xc |
- harden-runner Vendorstep-security Affected before 2.10.2 Fixed in 2.10.2 Patch available CNA
- step-security/harden-runner (GitHub Actions) Vendor— Affected before 2.10.2 Fixed in 2.10.2 Patch available GHSA-g85v-wf27-67xc
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:step_security:harden_runner:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:step_security:harden_runner:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA harden-runner (step-security) Fixed in 2.10.2
- Fix · GHSA-g85v-wf27-67xc step-security/harden-runner (GitHub Actions) Fixed in 2.10.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52587
- 2026-10-03 Alias added: GHSA-g85v-wf27-67xc
References
Other 9
- https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc
- https://github.com/step-security/harden-runner/commit/0080882f6c36860b6ba35c610c98ce87d4e2f26f
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169
- https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229
- https://github.com/step-security/harden-runner
More step-security vulnerabilities
- TI-2026-20705 Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier) CVSS 4.0MEDIUM 6.3
- TI-2025-23965 Harden-Runner Evasion of 'disable-sudo' policy CVSS 3.1MEDIUM 6.0
- TI-2026-25395 Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) CVSS 4.0MEDIUM 4.6
- TI-2026-25394 Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) CVSS 4.0MEDIUM 4.6
Sources
- CVE-2024-52587 · CVE Program
- CVE-2024-52587 · NVD
- FIRST EPSS
- GHSA-g85v-wf27-67xc · GitHub Advisory Database · CC BY 4.0
- CVE-2024-52587 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences