CVE-2022-39321

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered in versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use container actions, job containers, or service containers alongside untrusted user inputs in environment variables may be vulnerable. The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers in versions 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4. GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions. As a workaround, users may consider removing any container actions, job containers, or service containers from their jobs until they are able to upgrade their runner versions.

• CWE-78
• CWE-78

• https://github.com/actions/runner/pull/2107Patch, Release Notes, Third Party Advisory
• https://github.com/actions/runner/pull/2108Patch, Third Party Advisory
• https://github.com/actions/runner/security/advisories/GHSA-2c6m-6gqh-6qg3Third Party Advisory
• https://github.com/actions/runner/pull/2107Patch, Release Notes, Third Party Advisory
• https://github.com/actions/runner/pull/2108Patch, Third Party Advisory
• https://github.com/actions/runner/security/advisories/GHSA-2c6m-6gqh-6qg3Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39315Kirby is a Content Management System. Prior to versions 3.5.…5.3
• CVE-2022-39316FreeRDP is a free remote desktop protocol library and client…5.7
• CVE-2022-39317FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-39318FreeRDP is a free remote desktop protocol library and client…5.7
• CVE-2022-39319FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-39320FreeRDP is a free remote desktop protocol library and client…4.6
• CVE-2022-39322@keystone-6/core is a core package for Keystone 6, a content…9.8
• CVE-2022-39323GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…9.8
• CVE-2022-39324Grafana is an open-source platform for monitoring and observ…3.5
• CVE-2022-39325BaserCMS is a content management system with a japanese lang…6.1
• CVE-2022-39326kartverket/github-workflows are shared reusable workflows fo…8.8
• CVE-2022-39327Azure CLI is the command-line interface for Microsoft Azure.…9.8