Later archive addition

PPE — Poisoned Pipeline Execution

Omer Gil and Daniel Krivelevich · Cider Security · 9 February 2022

Explains poisoned pipeline execution through direct changes to CI configuration and indirect control of scripts, tests or other build inputs. The analysis connects repository permissions and execution triggers to stage-specific credentials and build-node privileges, with diagnostic examples across CI environments.

Record

Researcher

Omer Gil and Daniel Krivelevich

Published by

Cider Security

Date

9 February 2022

In the archive

• Added to the 2022 archive after the original list was published

Related sources

• Foundational Terraform-plan research
• Foundational Terraform-plan explanation

Tags

• ci-cd
• supply-chain
• command-injection
• privilege-escalation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a06-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Omer Gil and Daniel Krivelevich, first published at the original source. Preserved copies are kept so the citation survives its host.