Executive brief
ciguard is a tool used to scan software repositories for pipeline configuration files. A vulnerability allows a malicious repository to use symbolic links to trick the scanner into reading sensitive files from the user's computer, such as AWS credentials or system configurations, that are outside the intended scan folder. This could lead to the theft of secrets or internal network information if a user or AI agent is tricked into scanning a malicious directory.
Technical details
The `discover_pipeline_files()` function in `src/ciguard/discovery.py` (introduced in v0.8.0) walks directory trees and follows symbolic links without verifying if the resolved path remains within the intended root directory. An attacker can exploit this by placing a malicious symlink in a repository; when a user or AI agent (via the MCP server) scans that directory, the tool will follow the link to arbitrary locations on the filesystem (e.g., `~/.aws/` or `/etc/`). This is a 'confused deputy' attack that can result in the disclosure of sensitive pipeline-shaped files containing secrets or internal hostnames. The issue is fixed in version 0.8.2 by disabling symlink following by default and implementing a 'belt-and-braces' check to ensure resolved paths are children of the scan root.
Affected products
- Jo-Jo98 ciguard >= 0.8.0, <= 0.8.1
Timeline
- 2026-04-26: disclosed: Found during internal penetration test.
- 2026-04-26: patched: Fix released in v0.8.2.
- 2026-05-05: advisory: GitHub Advisory published.