Advisories
Subscribe to advisories

2026

Secrets in the debug log artifact of the AWS test workflows

Category: Pipelines

The AWS test workflows in the pipeline template uploaded a debug log containing secrets as a public workflow artifact, letting anyone signed in to GitHub read them

Published 2 days ago

Security
Severity: High

Bot token theft via the pipeline template's fix-linting workflow

Category: Pipelines

A workflow in the pipeline template ran a contributor’s own lint configuration with access to a shared bot token, letting an outside attacker run code on nf-core’s CI and steal the token

Published 2 days ago

Security
Severity: Critical

Merged families use the wrong sample's seed MSAs in proteinfamilies pipeline 2.0.0 - 2.4.0

Category: Pipelines

MERGE_FAMILIES:MERGE_SEEDS paired every sample with the first sample’s seed alignments

Published about 2 months ago

Known Regression
Severity: High

Remote code execution and bot token theft via the pipeline template's PR-comment workflow

Category: Pipelines, Configuration

A workflow in the pipeline template ran a value taken from a contributor’s pull request as a command, letting an outside attacker run code on nf-core’s CI and steal a shared bot token

Published 3 months ago

Security
Severity: Critical

2025

Final family representative sequences are faulty in proteinfamilies pipeline 1.3.0

Category: Pipelines

Bug inside the extract_family_reps.py script of v1.3.0

Published about 1 year ago

Known Regression
Severity: High

.command.run Permission denied

Category: Pipelines, Configuration

Nextflow versions after 24.10.6 are incompatible with certain nf-core pipelines published in 2024 and early 2025.

Affects: Nextflow: >=25.04.0 <25.04.3

Published over 1 year ago

Incompatibility
Severity: High

2023

Trimming parameters ignored in RNA-seq pipeline 3.10

Category: Pipelines

The clip parameters for read trimming remain without affect for that pipeline version

Published over 3 years ago

Known Regression
Severity: Low

2001

A faulty Answer to Life, the Universe, and Everything

Category: Pipelines, Modules, Subworkflows, Configuration

A critical mistake affecting the meaning of life calculations

Affects: Nextflow: 42.0.0 42.1.0 42.2.0-nightly Executors: Local Dependencies: Singularity (3.8.1)

Published over 25 years ago

Security Performance Data Corruption
Severity: Critical