Security scanners embedded in software development pipelines are designed to identify vulnerabilities and harden code. However, they can also become a gateway for attackers if not properly secured themselves.
A recent investigation by security researchers at ZeroPath has uncovered a worrying trend where specialized application security scanning tools can be compromised to serve as a foothold for downstream attacks. The team’s research, set to be presented next week at the Black Hat USA conference in Las Vegas, shows that attackers can use security scanners to execute malicious code and gain access to sensitive data.
The ZeroPath researchers conducted an extensive investigation into the susceptibility of 20 unnamed security vendors’ scanning tools. They discovered significant vulnerabilities in five of them, with one vendor even awarding the maximum-sized bug bounty for their findings. The identified issues included the exposure of sensitive secrets such as cloud credentials, production databases, and personal access tokens.
The research began when ZeroPath’s co-founder and CTO, Raphael Karger, noticed a suspicious alert in their own environment. Upon further investigation, they found evidence of an attacker probing their scanning tools’ defenses. The attacker was testing how the scanner dealt with arbitrary files, dependency handling procedures, and secrets handling. This led the team to build a tool that would test their own environment for similar vulnerabilities.
The key issue here is that many security scanners execute code and examine files without proper isolation. If an attacker can manipulate the repository being scanned, they can plant malicious content that will be executed by the scanner. For example, if a tool scans cloud configuration files for security problems, an attacker could create a custom rule that contains malicious code.
This research highlights the importance of securing not just the software development pipeline but also the tools used within it. As Karger notes, “These instances could have reached customers who thought they were secure.” This is a sobering reminder that even with robust security measures in place, there can still be vulnerabilities waiting to be exploited.
For developers and security teams, this research should serve as a wake-up call to review their scanning tools’ defenses. It’s essential to ensure that these tools are properly configured and isolated from the rest of the system to prevent attacks like the one described here. By doing so, we can reduce the risk of downstream attacks and maintain the integrity of our software supply chain.
As a practical takeaway, security teams should prioritize regular vulnerability assessments of their scanning tools and ensure they have proper isolation mechanisms in place. This includes reviewing how these tools handle arbitrary files, dependency handling procedures, and secrets handling. By taking proactive steps to secure these critical components, we can mitigate the risk of attacks that target our own defenses.
Source: Dark Reading — 2026-07-29