GitHub Updates actions/checkout to Block pull_request_target Attacks
Update actions/checkout to the latest version to block pull_request_target workflow attacks.
Update actions/checkout to the latest version to block pull_request_target workflow attacks.
Summary
GitHub has released a critical update to its actions/checkout action that blocks pwn request attacks exploiting the pull_request_target workflow trigger.
The new version prevents malicious code from running with full workflow privileges when a pull request is opened.
Effective June 18, 2026, all users of the official GitHub action must upgrade to the latest release.
The update addresses a known vulnerability that could allow attackers to inject arbitrary code into CI pipelines.
Security teams should verify that their workflows are using the protected version of actions/checkout.
Failure to upgrade could expose repositories to supply‑chain attacks that bypass standard security checks.
GitHub recommends updating the action in all repositories that rely on pull_request_target triggers.
Key changes
- actions/checkout updated to block pwn request attacks
- Blocks risky use of pull_request_target trigger
- Effective June 18, 2026
- Prevents malicious code running with full privileges
- Official GitHub action for checking out repository