Debug logging in zizmor version 1.27.0 serializes parsed configuration with a derived Debug implementation for GitHubToken, causing GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, and related command line options to be written to stderr in cleartext. This credential disclosure can allow an attacker to obtain access tokens with the scopes, repository access, and lifetime granted by the token, leading to potential unauthorized repository access or CI/CD manipulation. The vulnerability is rooted in Improper Log Redaction, identified by CWE‑532.

Affected systems include the zizmorcore:zizmor product in version 1.27.0. All installations using this version are vulnerable until upgraded to version 1.28.0, which removes the insecure logging behavior. No other versions are listed as impacted.

The CVSS score of 7 indicates a high severity, though no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the CI logs, support artifacts, terminal output, or public bug reports where the debug output is present. An attacker can leverage any medium that captures or publishes these logs, bypassing the need for remote code execution. The attack vector is thus local log capture or compromised log storage, not network-based exploitation.