Chainguard Academy Edu
Monthly
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
Trailing-slash directory redirects emitted by Chainguard Academy's nginx configuration downgrade clients to plaintext HTTP, because the redirect is built from the $scheme variable and TLS terminates at the Cloud Run load balancer in front of Nginx, making $scheme evaluate to "http". An attacker who already holds an on-path (MITM) network position can therefore read or modify documentation content delivered to a victim who requests a slashless directory path over HTTPS, but only when the client does not enforce HSTS - command-line HTTP clients and scripts that follow redirects are affected, while HSTS-preload browsers are not, since the .dev top-level domain is on the preload list. This is a low-severity issue (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R with low integrity impact only), and no public exploit was identified at time of analysis.
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
Trailing-slash directory redirects emitted by Chainguard Academy's nginx configuration downgrade clients to plaintext HTTP, because the redirect is built from the $scheme variable and TLS terminates at the Cloud Run load balancer in front of Nginx, making $scheme evaluate to "http". An attacker who already holds an on-path (MITM) network position can therefore read or modify documentation content delivered to a victim who requests a slashless directory path over HTTPS, but only when the client does not enforce HSTS - command-line HTTP clients and scripts that follow redirects are affected, while HSTS-preload browsers are not, since the .dev top-level domain is on the preload list. This is a low-severity issue (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R with low integrity impact only), and no public exploit was identified at time of analysis.