CVE-2022-39321

score

<0.1

cvss

8.8

epss

1.6%

published

2022-10-25

kev added

—

first seen

2026-10-21

GitHub Actions Runner versions prior to 2.296.2, 2.293.1, 2.289.4, 2.285.2, and 2.283.4 contain a command injection caused by improper environment variable encoding in docker commands, letting attackers modify docker invocation directly, exploit requires use of container actions or service containers with untrusted inputs.