Researchers at Cider Security have uncovered a security loophole in GitHub Actions that allows adversaries to bypass the required reviews mechanism and push non-reviewed code to a protected branch, allowing it into the pipeline to production. See Also:

Read full article on bankinfosecurity.com