Nnunet
Monthly
Agentic workflow injection in nnU-Net's GitHub Actions issue-triage automation (prior to 2.4.1) lets any logged-in GitHub user hijack a command-capable Claude agent by opening a crafted issue. Because the workflow embeds untrusted issue title/body directly into the LLM prompt and grants the agent authenticated gh permissions to comment and relabel issues, an external attacker can steer it beyond triage into performing repository actions on their behalf. A proof-of-concept is indicated (SSVC exploitation=poc), but EPSS is very low (0.04%) and it is not in CISA KEV, so no active exploitation is confirmed.
Agentic workflow injection in nnU-Net's GitHub Actions issue-triage automation (prior to 2.4.1) lets any logged-in GitHub user hijack a command-capable Claude agent by opening a crafted issue. Because the workflow embeds untrusted issue title/body directly into the LLM prompt and grants the agent authenticated gh permissions to comment and relabel issues, an external attacker can steer it beyond triage into performing repository actions on their behalf. A proof-of-concept is indicated (SSVC exploitation=poc), but EPSS is very low (0.04%) and it is not in CISA KEV, so no active exploitation is confirmed.