BoostSecurity Blog company blog
Weaponizing Dependabot: Pwn Request at its finest
Your trusty Dependabot (and other GitHub bots) might be an unwitting accomplice. Through "Confused Deputy" attacks, they can be tricked into merging malicious code. This doesn't stop here. It can escalate to full command injection via crafted branch names and even bypass branch protection rules. Plus, we disclose two…
- Points
- 111
- HN comments
- 58
- Submissions
- 1
- Cited by
- 0 commenters
Security & PrivacySoftware Engineering2025
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Jun 6, 2025 | Weaponizing Dependabot: Pwn Request at its finest by chha | 111 | 58 |
