GitHub says it has fixed major security flaw – TechRadar

A severe GitHub security flaw has finally been fixed more than three months after it was first discovered. 
Back in July, Googles Project Zero team notified GitHub that its GitHub Actions feature was highly vulnerable to injection attacks. The firm was given 90 days to patch the flaw, plus a 14-day additional grace period, before it was disclosed publicly.
GitHub managed to solve the issue on November 16, however, by disabling two old runner commands. The former version of the “set-env” runner command,…

Click here to view the original article.