< h 2 > Scroll ing through the vulnerability advisory last Friday night , my palms were sweating </ h 2 >< p > Scroll ing through this vulnerability advisory last Friday night , my palms were sweating —all my client projects are on GitHub . If you use GitHub to store code or run automated deployments , this vulnerability called CVE - 202 6 - 38 5 4 is worth 10 minutes of our time . Simply put , someone could remotely execute arbitrary code on your server through GitHub 's automation feature called Actions . It sounds scary , but GitHub has already fixed it ; what we need to do is self -check our settings .</ p >< h 2 > What this bug is — Aj ie almost got hit </ h 2 >< p > Dis covered by the W iz security team , this vulnerability exploits GitHub Actions ' permission mechanism . My friend Aj ie , who runs an independent design studio , was modifying a client 's project code in a cafe in Hang zhou last Wednesday when he found an unidentified script running in his Actions log — fortunately , it was just a test repo ; it would have been a disaster if it were the production environment . I 've made similar mistakes before : for convenience , I gave write permissions to Actions for all repositories , which was like leaving the front door wide open for anyone . This vulnerability doesn 't discriminate ; as long as we use Actions automation , there 's a risk .</ p >< h 2 >Your self -check cost today </ h 2 >< p >$ 0 + 10 minutes + Technical barrier : Just be able to log into the GitHub backend and check settings . First step : Log into GitHub , click into Settings of any repo , find Actions → General on the left , and see if " Workflow permissions " is set to " Read " or " Read and write " . If it 's the latter , and we don 't have a specific scenario requiring write permissions , changing it back to Read is fine . This tool isn 't needed for everyone —if you 've never turned on Actions , it 's fine not to check now .</ p >< h 2 > Advice by stage </ h 2 >< p > Just starting out : If we only use GitHub to store code and haven 't touched Actions automation , the impact is minimal . Just glance at the permissions next time you log in , no rush . 1 - 2 clients : If we use Actions to auto -de ploy websites , I 'd suggest checking the Actions permissions for every repo today , and whether the third -party actions referenced in the workflow files are from trusted sources . Scaling up : If multiple team members have admin privileges , I recommend immediately auditing all repo permissions , enabling branch protection , and restricting who can modify workflow files . I got stuck here before too , spending a whole afternoon sorting it out , but it was worth it .</ p >