CVE-2026-31976 xygeni-action v5 tag poisoned with C2 backdoor
Attackers poisoned a GitHub Action tag to inject a backdoor, allowing arbitrary command execution on CI runners for workflows using the compromised version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31976?
CVE-2026-31976 is a critical vulnerability in xygeni-action, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the unmerged PRs. This commit remained in the repository's git object store, and any workflow referencing @v5 would fetch and execute it. This is a supply chain compromise via tag poisoning. Any GitHub Actions workflow referencing xygeni/xygeni-action@v5 during the affected window (approximately March 3–10, 2026) executed a C2 implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run.
Weakness: CWE-506
Which versions are affected by CVE-2026-31976?
1 open source package ship an affected version, including xygeni/xygeni-action. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xygeni/xygeni-action GitHub Actions | From 5 | 6.4.0 |
Products include Xygeni Xygeni-Action.
How do I fix CVE-2026-31976?
Upgrade xygeni/xygeni-action to 6.4.0 or later.
Is CVE-2026-31976 being exploited?
There is no known exploitation of CVE-2026-31976 in the wild and no public exploit code.
Sources
Also known as GHSA-f8q5-h5qh-33mh.