CYCODE DISCOVERS A SUPPLY CHAIN VULNERABILITY IN BAZEL

Summary from the TLDR InfoSec newsletter

A blog post from Cycode detailing a supply chain vulnerability that it discovered in Bazel. The post begins with an overview of GitHub Custom Actions and then details how Cycode leveraged a custom action in Bazel to achieve remote code execution. The Bazel project included a custom action that passed the user-controlled issue body directly to a bash shell in the GitHub runner which was vulnerable to command injection.