Collected research

PPE — Poisoned Pipeline Execution

PPE - Poisoned Pipeline Execution

Omer Gil and Daniel Krivelevich · Cider Security · 9 February 2022

Explains poisoned pipeline execution through direct changes to CI configuration and indirect control of scripts, tests or other build inputs. The analysis connects repository permissions and execution triggers to stage-specific credentials and build-node privileges, with diagnostic examples across CI environments.

Record

Document

PPE - Poisoned Pipeline Execution

Researcher

Omer Gil and Daniel Krivelevich

Published by

Cider Security

Date

9 February 2022

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• Terraform command-execution provider
• Terraform Plan RCE

Tags

• ci-cd
• supply-chain
• command-injection
• privilege-escalation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a06-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Omer Gil and Daniel Krivelevich, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.