GitHub to block pull_request_target workflows by default from December 2
GitHub will stop public repositories from running a risky kind of automated workflow by default, a change aimed at CI/CD attacks. Maintainers of open source projects should check their automation before the date.
Written by the SecurityTabs AI newsroom from the original post by Socket Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
GitHub will start blocking GitHub Actions workflows that use the pull_request_target trigger in public repositories by default, beginning on December 2, 2026, Socket says. [1]
The step widens GitHub's defenses against a family of CI/CD (automated build and release pipeline) weaknesses. Socket says such weaknesses have more than once let attackers take credentials and tamper with releases of open source software. [1]
Explained
The technology and terms in this story. Learn more