CVE-2024-52587

StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the first step in a job, the likelihood of exploitation is low as the Harden-Runner action reads the environment variable during the pre-step stage. There are no known exploits at this time. Version 2.10.2 contains a patch.

• CWE-78

• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L40-L44
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L53
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L57
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/arc-runner.ts#L61
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L169
• https://github.com/step-security/harden-runner/blob/951b48540b429070694bc8abd82fd6901eb123ca/src/setup.ts#L229
• https://github.com/step-security/harden-runner/commit/0080882f6c36860b6ba35c610c98ce87d4e2f26f
• https://github.com/step-security/harden-runner/security/advisories/GHSA-g85v-wf27-67xc

Published

Nov 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52581Litestar is an Asynchronous Server Gateway Interface (ASGI) …7.5
• CVE-2024-52582Cachi2 is a command-line interface tool that pre-fetches a p…4.7
• CVE-2024-52583The WesHacks GitHub repository provides the official Hackath…8.2
• CVE-2024-52584Autolab is a course management service that enables auto-gra…5.4
• CVE-2024-52585Autolab is a course management service that enables auto-gra…5.4
• CVE-2024-52586eLabFTW is an open source electronic lab notebook for resear…7.8
• CVE-2024-52588Strapi is an open-source content management system. Prior to…7.5
• CVE-2024-52589Discourse is an open source platform for community discussio…2.7
• CVE-2024-5259The MultiVendorX Marketplace – WooCommerce MultiVendor Marke…5.4
• CVE-2024-52590Misskey is an open source, federated social media platform. …6.5
• CVE-2024-52591Misskey is an open source, federated social media platform. …9.3
• CVE-2024-52592Misskey is an open source, federated social media platform. …5.3