Chainguard Academy CVE-2026-105767

Exploitation requires an actor to control the project_id or storage_bucket inputs passed to the integrate-platform-docs composite action in the chainguard-dev/edu repository, in the commit range 7375a80 through (not including) fb0efb2; those inputs are interpolated unquoted into Bash gcloud storage cp commands via ${{ inputs.* }} expressions. What strongly limits real-world exploitation: in the actual repository the sole caller supplied these inputs from repository secrets and ran only on trusted triggers, so untrusted input was not known to reach the vulnerable steps. Practical abuse therefore depends on an attacker already having the privilege to alter the workflow inputs or introduce a malicious caller - i.e. write/maintainer access to the CI configuration - rather than any remote, unauthenticated path against a default deployment.

This is a genuinely low-priority issue despite being a command-injection (CWE-78) flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N) scores only 2.1, and that low score is well-justified by the context: exploitation requires high privileges (PR:H) because the vulnerable project_id and storage_bucket inputs are supplied by repository secrets, and the attack-requirements metric (AT:P) reflects that untrusted input must first reach those steps - which the description explicitly says did not happen, since the only in-repository caller passed trusted secrets on trusted triggers. There is no EPSS score, no CISA KEV listing, and no public exploit identified in the provided data, all of which are consistent with the low CVSS rating rather than conflicting with it. The one nuance worth flagging: the vendor vector lists AV:N (network), but the real exploitation path is effectively repo-/supply-chain-local - an actor would need write control over the workflow inputs or the ability to introduce a malicious caller - so the network vector overstates reachability. Impact is also bounded to the GitHub Actions runner context (leakage/abuse of that job's credentials), not a broader system. Net: a correctly-handled, already-patched hardening fix, not an active threat.

An actor able to control the project_id or storage_bucket inputs to the integrate-platform-docs composite action (for example, by adding a malicious caller workflow or supplying attacker-chosen input values) embeds shell metacharacters that are interpolated directly into the gcloud storage cp command, executing arbitrary commands on the GitHub Actions runner and potentially exfiltrating that job's secrets. In the actual repository, the only caller passed repository secrets on trusted triggers, so no untrusted input was known to reach these steps. No public exploit code was identified at the time of analysis.