{
  "apiVersion": "v1",
  "resource": "security",
  "slug": "actions-runner",
  "image": "ghcr.io/quenchworks/images/actions-runner",
  "source": "QuenchWorks nightly Trivy scan (each published image digest)",
  "links": {
    "image": "/api/v1/security/actions-runner.json"
  },
  "version": "2.338.0",
  "tag": "ghcr.io/quenchworks/images/actions-runner:2.338.0",
  "critical": 3,
  "high": 38,
  "medium": 15,
  "low": 1,
  "unknown": 0,
  "total": 57,
  "fixable": 57,
  "grade": "F",
  "score": 0,
  "cves": [
    {
      "id": "CVE-2026-111497",
      "severity": "CRITICAL",
      "pkg": "libbrotlicommon1",
      "installed": "1.2.0-r5",
      "fixed": "1.2.0-r7",
      "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
      "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-111497",
      "severity": "CRITICAL",
      "pkg": "libbrotlidec1",
      "installed": "1.2.0-r5",
      "fixed": "1.2.0-r7",
      "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
      "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-111497",
      "severity": "CRITICAL",
      "pkg": "libbrotlienc1",
      "installed": "1.2.0-r5",
      "fixed": "1.2.0-r7",
      "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
      "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-105482",
      "severity": "HIGH",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
      "url": "https://avd.aquasec.com/nvd/cve-2026-105482",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-105483",
      "severity": "HIGH",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
      "url": "https://avd.aquasec.com/nvd/cve-2026-105483",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-106069",
      "severity": "HIGH",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames",
      "url": "https://avd.aquasec.com/nvd/cve-2026-106069",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-111943",
      "severity": "HIGH",
      "pkg": "ca-certificates-bundle",
      "installed": "20260909-r2",
      "fixed": "20260909-r3",
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
      "url": "https://avd.aquasec.com/nvd/cve-2026-111943",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-58280",
      "severity": "HIGH",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2",
      "title": "dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-58280",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-69651",
      "severity": "HIGH",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
      "title": "dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-69651",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-84008",
      "severity": "HIGH",
      "pkg": "System.Security.Cryptography.Pkcs",
      "installed": "10.0.12",
      "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
      "title": "dotnet: .NET Denial of Service Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-84008",
      "targets": [
        "home/runner/bin/Runner.Common.deps.json",
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json",
        "home/runner/bin/Sdk.deps.json"
      ]
    },
    {
      "id": "CVE-2026-92392",
      "severity": "HIGH",
      "pkg": "curl",
      "installed": "8.22.0-r4",
      "fixed": "8.23.0-r0",
      "title": "curl: curl: HTTP/2 upload Use-After-Free",
      "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-92392",
      "severity": "HIGH",
      "pkg": "libcurl-openssl4",
      "installed": "8.22.0-r4",
      "fixed": "8.23.0-r0",
      "title": "curl: curl: HTTP/2 upload Use-After-Free",
      "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-96225",
      "severity": "HIGH",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21",
      "title": "dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-96225",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-96231",
      "severity": "HIGH",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2",
      "title": "dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-96231",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-96233",
      "severity": "HIGH",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32",
      "title": "dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-96233",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-105481",
      "severity": "MEDIUM",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse",
      "url": "https://avd.aquasec.com/nvd/cve-2026-105481",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-106072",
      "severity": "MEDIUM",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification",
      "url": "https://avd.aquasec.com/nvd/cve-2026-106072",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-106074",
      "severity": "MEDIUM",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse",
      "url": "https://avd.aquasec.com/nvd/cve-2026-106074",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    },
    {
      "id": "CVE-2026-66822",
      "severity": "MEDIUM",
      "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installed": "8.0.31",
      "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
      "title": "dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability",
      "url": "https://avd.aquasec.com/nvd/cve-2026-66822",
      "targets": [
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json"
      ]
    },
    {
      "id": "CVE-2026-70162",
      "severity": "MEDIUM",
      "pkg": "System.Security.Cryptography.Pkcs",
      "installed": "10.0.12",
      "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
      "title": "dotnet: dotnet: Denial of Service via specially crafted web requests",
      "url": "https://avd.aquasec.com/nvd/cve-2026-70162",
      "targets": [
        "home/runner/bin/Runner.Common.deps.json",
        "home/runner/bin/Runner.Listener.deps.json",
        "home/runner/bin/Runner.PluginHost.deps.json",
        "home/runner/bin/Runner.Plugins.deps.json",
        "home/runner/bin/Runner.Sdk.deps.json",
        "home/runner/bin/Runner.Worker.deps.json",
        "home/runner/bin/Sdk.deps.json"
      ]
    },
    {
      "id": "CVE-2026-106073",
      "severity": "LOW",
      "pkg": "nodejs-24",
      "installed": "24.21.0-r4",
      "fixed": "24.22.1-r0",
      "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()",
      "url": "https://avd.aquasec.com/nvd/cve-2026-106073",
      "targets": [
        "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
      ]
    }
  ]
}