GitHub CodeQL flaw lets attackers hijack Actions and steal private code
Praetorian uncovered a race‑condition in GitHub CodeQL that lets an attacker inject code into nearly any repository's Actions workflow, exfiltrating private source and stealing secrets. The flaw, tracked as CVE‑2025‑24362, turns the default CodeQL security scan into a supply‑chain weapon. GitHub says no platform compromise has been observed.