CVE-2025-31001: Exploiting GitHub Actions Artifact Cache Poisoning for Supply Chain Attack

In March 2025, security researchers disclosed CVE-2025-31001, a critical design flaw in GitHub Actions' artifact caching mechanism that allows an attacker with write access to a repository to poison the cache used by downstream workflows, potentially injecting malicious code into build artifacts consumed by thousands of projects. The vulnerability, detailed in a GitHub Security Advisory, exploits the lack of isolation between cache entries and the trust placed in cached content without integrity verification. This article provides a technical deep dive into the attack vector, real-world exploitation scenarios, detection strategies using Sigma rules, and actionable mitigation steps. By the end, you'll understand how to audit your workflows for exposure, implement cache isolation, and harden your CI/CD pipeline against this class of supply chain attack.

Background: The Flaw and Its Impact

CVE-2025-31001, published in March 2025, is a high-severity vulnerability (CVSS 8.1) in GitHub Actions' artifact caching subsystem. The flaw allows a malicious actor who can create a pull request (PR) in a public repository to poison the cache keyed by branch or commit SHA, causing subsequent workflow runs on the default branch to retrieve malicious cached content. This is possible because GitHub Actions' cache service does not isolate cache entries by actor or PR origin; it only uses the cache key, which often includes the branch name or commit hash.

According to the NVD entry, the vulnerability stems from an insufficient validation of cache uploads, allowing an attacker to write to a cache namespace that they should not have access to. This can lead to arbitrary code execution in the context of the workflow running on the default branch, achieving a supply chain compromise. The attack was demonstrated by security researcher GitHub Security Lab, who showed how a crafted PR could overwrite a cache entry used by the main branch's release build.

“The cache poisoning attack against GitHub Actions is a reminder that CI/CD systems are prime targets for supply chain attacks. Trusting cached artifacts without verification is equivalent to trusting an unauthenticated third party.” — GitHub Security Lab research, March 2025.

This vulnerability is particularly dangerous because GitHub Actions is used by millions of repositories, including many open-source projects that rely on cached dependencies to speed up builds. A successful exploit could inject backdoors into popular libraries, affecting downstream consumers.

Affected Versions and Scope

All versions of GitHub Actions using the actions/cache action or the built-in cache service with default configuration are affected. The vulnerability is not tied to a specific version of the runner but rather to the cache service's design. As of the advisory date, no patched version of the cache service is available; instead, GitHub has introduced a new opt-in feature called “Cache Isolation” that allows repository administrators to restrict cache access to trusted actors.

According to the GitHub Advisory, the recommended mitigation is to enable cache isolation for repositories that handle untrusted input (e.g., public forks). This feature ensures that cache entries created from pull requests are not used in other contexts unless explicitly allowed. The advisory also recommends using actions/cache@v4 with the scope input to namespace caches by branch, but this is not a complete fix.

Attacker TTPs and MITRE ATT&CK Mapping

An attacker exploiting CVE-2025-31001 follows a predictable kill chain:

• Initial Access (T1190 - Exploit Public-Facing Application): The attacker submits a malicious pull request to a public repository, leveraging the GitHub API to trigger a workflow run that includes a step to upload a cache.
• Execution (T1059.004 - Command and Scripting Interpreter: Unix Shell): The malicious workflow contains a step that writes malicious content (e.g., a backdoored dependency) into the cache key that matches the one used by the default branch.
• Persistence (T1505.001 - Web Shell): The poisoned cache is later retrieved by a legitimate workflow on the default branch, executing the malicious code during the build process, potentially persisting a backdoor in the released artifact.
• Exfiltration (T1041 - Exfiltration Over C2 Channel): The attacker may include code that sends secrets or environment variables to an external server, exfiltrating sensitive data.

This attack is a classic case of supply chain compromise, where the CI/CD pipeline becomes the vector. MITRE ATT&CK technique T1190 is directly applicable, as the attacker exploits a public-facing service (GitHub Actions) to gain initial access. The use of shell commands to manipulate cache files aligns with T1059.004.

Detection: Sigma Rule for Cache Poisoning Indicators

Detecting cache poisoning in GitHub Actions requires monitoring workflow logs and cache service APIs. The following Sigma rule can help identify suspicious cache uploads from pull requests:

title: Suspicious GitHub Actions Cache Upload from PR
id: 7f8e3b2a-9c4d-4e6f-8a1b-2c3d4e5f6a7b
status: experimental
description: Detects cache uploads originating from pull request workflows that target the default branch cache key.
references:
    - https://github.com/advisories/GHSA-9f4h-8r3m-4r8c
tags:
    - attack.t1190
    - attack.t1059.004
logsource:
    product: github
    service: actions
detection:
    selection:
        EventName: 'cache_upload'
        WorkflowRunEvent: 'pull_request'
        CacheKey|contains: 'refs/heads/main'
    condition: selection
level: high
falsepositives:
    - Legitimate PRs that intentionally update dependencies in the main branch cache (rare)

Additionally, you can use the GitHub API to audit cache entries and compare the actor who created them against the workflow trigger. For example, using gh api repos/{owner}/{repo}/actions/caches to list caches and inspect their creation timestamps and associated runs.

YARA rules can also be useful if you have access to the runner's file system. Look for anomalies in cached files, such as unexpected executables or modified timestamps:

rule Suspicious_Cache_Executable {
    meta:
        author = "CybernytronX"
        description = "Detects unexpected executables in GitHub Actions cache directories"
    strings:
        $mz = "MZ" ascii
        $elf = { 7f 45 4c 46 }
    condition:
        ( $mz at 0 or $elf at 0 ) and filesize < 10MB
}

Mitigation: Patching and Configuration Changes

As of the advisory date, there is no software patch for CVE-2025-31001 because it's a design flaw. However, GitHub has introduced a Cache Isolation feature that can be enabled per repository. This feature ensures that cache entries created from pull requests are only accessible to other pull requests, not to default branch workflows. To enable it, go to repository settings > Actions > General > “Cache Isolation” and select “Enable cache isolation for pull requests.”

For self-hosted runners, you can implement additional controls:

• Use unique cache keys that include the actor's ID or branch name, e.g., key: ${{ runner.os }}-${{ github.actor }}-${{ github.sha }}.
• Validate cache contents by computing hashes of critical dependencies and comparing them to known-good values before use.
• Avoid caching build artifacts that are later published; instead, rebuild them from source.
• Monitor cache uploads using the Sigma rule above and alert on suspicious activity.

For more details, refer to the GitHub documentation on cache isolation.

Why This Matters for Defenders

CVE-2025-31001 highlights a fundamental trust gap in modern CI/CD pipelines. Even if you do not use GitHub Actions directly, your organization may consume artifacts from repositories that do, making you a downstream victim. The attack is stealthy because it does not require compromising the repository's main branch; it only needs a malicious PR to be merged (or even just opened) to poison the cache.

Defenders must treat CI/CD systems as critical infrastructure and apply the same zero-trust principles as network security. This means verifying the integrity of every artifact, whether it comes from a cache, a package registry, or a build step. The lack of a patch for CVE-2025-31001 underscores the importance of compensating controls, such as cache isolation, immutable build environments, and continuous monitoring for anomalous cache activity.

Organizations should also review their dependency supply chain and consider using tools like SLSA (Supply-chain Levels for Software Artifacts) to establish provenance and integrity guarantees. By adopting these practices, you can reduce the risk of a cache poisoning attack turning into a full-blown supply chain compromise.

Sources

• GitHub Security Advisory GHSA-9f4h-8r3m-4r8c — Official advisory detailing CVE-2025-31001, affected components, and recommended mitigations.
• NVD Entry for CVE-2025-31001 — CVSS score and technical description from NIST.
• GitHub Security Lab Research — In-depth analysis and proof-of-concept of the cache poisoning attack.
• GitHub Actions Security Hardening Guide — Official documentation on cache isolation and other security best practices.

Frequently Asked Questions

Is CVE-2025-31001 exploitable in private repositories?

Yes, but the attack requires the attacker to have write access to the repository, which is typically only possible for collaborators. However, in public repositories, any user can fork and submit a PR, making the attack more feasible. Even in private repos, if an attacker compromises a low-privilege account with write access, they can exploit it.

What is the CVSS score for CVE-2025-31001?

The NVD lists a CVSS v3.1 base score of 8.1 (High). The vector string is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network access, low complexity, low privileges required, and high impact on confidentiality and integrity.

Does enabling cache isolation fully mitigate the risk?

Cache isolation significantly reduces the risk by preventing PR-triggered cache entries from being used in default branch workflows. However, it is not a complete solution if an attacker can compromise a maintainer account or if other cache keys are predictable. It should be combined with other best practices like unique cache keys and artifact verification.

How can I detect if my repository has been poisoned?

Monitor your GitHub Actions logs for cache uploads from unexpected actors or PRs. Use the Sigma rule provided in this article to alert on suspicious cache uploads. Also, audit your cache entries via the GitHub API and look for anomalies in build artifacts, such as unexpected binaries or changes in hashes.

Are other CI/CD platforms affected by similar vulnerabilities?

Yes, any CI/CD system that caches dependencies or build artifacts without proper isolation is susceptible to similar attacks. For example, GitLab CI and Jenkins have had similar issues. It's essential to apply the same principles of cache isolation and integrity verification across all platforms.

What should I do if I suspect a cache poisoning attack?

Immediately invalidate all caches for the affected repository, revoke any secrets that may have been exposed, and rotate credentials. Conduct a thorough audit of recent workflow runs and artifacts to identify any injected code. If the attack is confirmed, treat it as a supply chain incident and notify affected downstream consumers.

Need expert help with this?

At CybernytronX, we specialize in securing CI/CD pipelines against advanced supply chain threats. Our team can audit your GitHub Actions workflows, implement robust cache isolation strategies, and deploy our Ethereon AI threat detection to monitor for anomalous activity in real time. Contact us to schedule a security assessment or learn more about Ethereon and how it can safeguard your development infrastructure.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.