Advisories
Subscribe to advisories

2026

Remote code execution and bot token theft via the pipeline template's PR-comment workflow

Category: Pipelines, Configuration

A workflow in the pipeline template ran a value taken from a contributor’s pull request as a command, letting an outside attacker run code on nf-core’s CI and steal a shared bot token

Published 2 days ago

Security
Severity: Critical

2025

Final family representative sequences are faulty in proteinfamilies pipeline 1.3.0

Category: Pipelines

Bug inside the extract_family_reps.py script of v1.3.0

Published 10 months ago

Known Regression
Severity: High

.command.run Permission denied

Category: Pipelines, Configuration

Nextflow versions after 24.10.6 are incompatible with certain nf-core pipelines published in 2024 and early 2025.

Affects: Nextflow: >=25.04.0 <25.04.3

Published about 1 year ago

Incompatibility
Severity: High

2023

Trimming parameters ignored in RNA-seq pipeline 3.10

Category: Pipelines

The clip parameters for read trimming remain without affect for that pipeline version

Published over 3 years ago

Known Regression
Severity: Low

2001

A faulty Answer to Life, the Universe, and Everything

Category: Pipelines, Modules, Subworkflows, Configuration

A critical mistake affecting the meaning of life calculations

Affects: Nextflow: 42.0.0 42.1.0 42.2.0-nightly Executors: Local Dependencies: Singularity (3.8.1)

Published about 25 years ago

Security Performance Data Corruption
Severity: Critical