Azure Pipelines Agent poisoned pipeline execution

Azure Pipelines and GitHub Actions allow deployment of runners and agents using VM images sourced from a GitHub-managed
repository (github.com/actions/runner-images). This repo was misconfigured to use self-hosted runners insecurely,
in a way that could have allowed a malicious external contributor (i.e., anyone who had previously had at least one PR
approved and merged in the repo) to poison the repository and achieve code execution on runners in the repo. This in turn
could have theoretically allowed an attacker to modify …

actions agent azure azure pipelines deployment external github github actions github.com images malicious managed misconfigured pipeline pipelines repo repository runners