Gitea Act Runner container escape via unsafe container options injection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•12

Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.