Miasma GitHub Actions Sudo Restoration Bypass

Tim Peck@timpeck

•updated Jun 10, 2026•6•0•62

Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.