{
  "id": 12110313,
  "title": "pull_request_target in the wild: 60 public workflows, 6 exploitable, and the fixes that actually work",
  "url": "https://urgent.news/2026/10/05/pull-request-target-in-the-wild-60-public-workflows-6-exploitable-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-05T08:49:16.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mag_solutions_ai/pullrequesttarget-in-the-wild-60-public-workflows-6-exploitable-and-the-fixes-that-actually-g23"
  },
  "original_language": "en",
  "account": "In a recent report, it was found that 60 public GitHub Actions workflows were analyzed, with 6 of them considered exploitable. These workflows were able to run code from pull requests using the trigger \"pull_request_target\", which can be dangerous if not properly managed. The report measured the issue twice, two weeks apart, and discovered a discrepancy in the effectiveness of a rule designed to mitigate the problem. The problem lies in the combination of three factors: the \"pull_request_target\" trigger, the checkout of the pull request's own code, and a step that executes that code. If any one of these is removed, the attack is eliminated. The report measured 6 exploitable workflows out of 60, or roughly 10%. The fixes that proved effective included using \"pull_request\" instead of \"pull_request_target\", gating the job behind an \"environment\" that requires approval, having a maintainer label for fork pull requests, and running the contributor's code in a separate, trusted checkout. The report advises readers to check their own repositories for similar issues by using specific grep commands. The figures provided are based on the measurements taken by the report's authors, not a comprehensive census of all GitHub workflows.",
  "summary": "pull_request_target is the GitHub Actions trigger behind a steady stream of security advisories titled some variant of \"secrets exfiltration via pull_request_target\". It runs in the context of the base repository, with its secrets and a token that can write, even when the pull request comes from a stranger's fork. On its own that is fine. It becomes a takeover when the workflow also checks out…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}