# xygeni-action v5 tag poisoned with C2 backdoor

Compromised GitHub App credentials let an attacker repoint the mutable v5 tag of xygeni/xygeni-action to an unmerged commit containing a C2 implant, executing on CI runners.

- Payout: Research
- Severity: critical
- Program: xygeni-action
- Found by: Nick2bad4u
- Disclosed: 2026-03-11
- CVE: CVE-2026-31976
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-f8q5-h5qh-33mh
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-f8q5-h5qh-33mh
- Tags: area:oss domain:oss impact:internal-access impact:rce kind:research platform:ghsa sev:critical tech:github-actions technique:recon technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** GitHub Actions action.yml (CI runner)
**Root cause:** Attacker with compromised GitHub App credentials moved the mutable v5 tag to a malicious commit from an unmerged PR, bypassing branch protection since the commit persisted in the git object store.
**Steps:**
1. Attacker opens PRs #46-#48 injecting obfuscated shell into `action.yml`; branch protection blocks merge.
2. Using compromised GitHub App credentials, move `v5` tag to malicious commit `4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12`.
3. Any workflow using `xygeni/xygeni-action@v5` fetches and runs the commit.
4. Malicious step registers runner with C2 `91.214.78.178` via `security-verify.91.214.78.178.nip.io`, sending hostname, username, OS version.
5. Polls C2 every 2-7s for 180s, `eval`-ing received shell commands and exfiltrating base64-compressed output.
**How found:** Analyst noticed the v5 tag pointed at a commit from an unmerged PR rather than a release commit, then reviewed action.yml for the injected telemetry step and traced C2 infrastructure.
**Exploitation:** Tag poisoning: workflows referencing @v5 during Mar 3-10 2026 executed the implant, giving the attacker arbitrary command execution on the CI runner for up to 180s per run, with access to all runner secrets.
**Escalation:** Implant runs alongside legitimate scan, suppresses errors, skips TLS verification, randomizes polling to evade detection; runner secrets (repo/env secrets, deploy keys, cloud tokens) exposed for lateral movement.
**Insight:** Mutable tags on GitHub Actions are a supply-chain attack surface: a tag can be repointed to any commit in the object store, including unmerged PR commits, so branch protection alone does not protect tag consumers. Audit tag-to-commit mappings against release commits.