CVE-2026-31976: Xygeni Action v5 Tag Poisoning with C2 Backdoor
Summary
CVE-2026-31976: xygeni-action v5 tag poisoned with C2 backdoor. Affects xygeni/xygeni-action versions >= 5, < 6.4.0. Fixed in 6.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xygeni Action is a GitHub Action designed for scanning and verifying code quality within CI/CD workflows. It allows developers to automate security checks and ensure that their code adheres to best practices. However, a recent vulnerability has been discovered that compromises the integrity of the v5 tag, allowing malicious code execution.
Vulnerability Detail
On March 3, 2026, an attacker exploited compromised GitHub App credentials to create pull requests that injected obfuscated shell code into the action's configuration file, action.yml. Although these pull requests were blocked from merging, the attacker managed to move the mutable v5 tag to point to a malicious commit. This allowed any workflow referencing @v5 to execute the malicious code, which connected to a command and control (C2) server, enabling arbitrary command execution on the CI runner. The implant operated silently, suppressing errors and evading detection, posing a significant risk to any workflows that utilized the compromised tag.
How To Fix
Minimum fixed version
6.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an alternative to using the compromised GitHub Action, users can install and run the Xygeni scanner directly via the CLI installation method. This bypasses the GitHub Action entirely and is not affected by this incident. Detailed instructions can be found at https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation.
Conclusion
The CVE-2026-31976 vulnerability in the Xygeni Action package represents a critical risk due to the potential for arbitrary command execution on CI runners. Users are strongly advised to update their workflows to the patched version and take necessary precautions if they were affected during the exposure window.
See every vulnerability recorded for xygeni/xygeni-action →
FAQ
The vulnerability is a supply chain compromise due to tag poisoning, allowing an attacker to execute arbitrary commands on CI runners.
If your workflows referenced @v5 between March 3 and March 10, 2026, they may have been affected by the malicious code.
You should rotate all secrets available to the CI runner, audit CI logs for suspicious activity, and review recent releases for signs of tampering.
Yes, the compromised v5 tag has been removed, and users should update to version 6.4.0 of the Xygeni Action.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
