In reply to @v12sec

V12

@v12sec · Twitter · 2026-09-08 14:00 UTC

When a victim views the job, arbitrary JavaScript runs in their session. This lets us mint a full-scope PAT, add SSH keys, and read or write private repos they can access. If the victim is a site admin, the token can create backdoor admins or reset any user’s password!