Researchers discovered vulnerabilities in the Nix ecosystem related to GitHub Actions, specifically concerning the pull_request_target event, which could allow for supply chain attacks and command injection. They identified two significant flaws: one involving xargs and the other enabling symbolic link exploitation, leading to unauthorized access to sensitive data. The maintainers acted quickly to disable the vulnerable workflows and implement fixes.

A significant vulnerability was discovered in the Open VSX marketplace, which could allow attackers to gain full control over millions of developer machines by publishing malicious updates to extensions. This flaw, rooted in a CI issue, underscores the risks associated with untrusted third-party software in development environments.