GitHub Actions shell injection in Wazuh workflows via pull request (CVE-2026-67308)

Wazuh CI workflows trigger on pull requests from public forks and read VERSION.json from the attacker-controlled repository, writing its raw contents into environment variables that are directly interpolated into shell run steps. Because GitHub Actions evaluates expression syntax before the shell starts, an attacker can inject shell metacharacters to execute arbitrary commands on self-hosted runners, enabling exfiltration of secrets including GITHUB_TOKEN and AWS credentials. Affected versions: - < 44bf114 We recommend updating to: 44bf114. CVSS 9.3 · our assessment: act_now Reference: https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh Details: https://vuln.today/cve/CVE-2026-67308