step-security/harden-runner Security Advisories | GitStock

medium2026-03-17

Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)

GHSA-46g3-37rh-v698 · CVE-2026-32947

medium2026-03-17

Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)

GHSA-g699-3x6g-wm3g · CVE-2026-32946

medium2026-02-09

Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

GHSA-cpmj-h4f6-r6pq · CVE-2026-25598

medium2025-04-22

Harden-Runner allows evasion of 'disable-sudo' policy

GHSA-mxr3-8whj-j74r · CVE-2025-32955

low2024-11-18

Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`

GHSA-g85v-wf27-67xc · CVE-2024-52587