EUVD-2026-42299Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack is internet-accessible via GitHub PR comments from any account; scope changes as injection crosses from GitHub platform to CI runner infrastructure holding deployment secrets.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a deploy command to execute shell commands on the CI runner and exfiltrate deployment secrets. This issue is reported as fixed in version 3.20.180.
AnalysisAI
CI/CD pipeline injection in ToolJet's GitHub Actions render-preview deployment workflow (versions prior to 3.20.180) allows any GitHub user who can comment on an open pull request to execute arbitrary shell commands on the CI runner and exfiltrate deployment secrets. The root cause is direct interpolation of github.event.comment.body - a fully attacker-controlled input - into a bash conditional run: step without sanitization. A proof-of-concept has been documented (SSVC: poc), the vendor has released a fix in 3.20.180, and the attack is not listed in CISA KEV at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection) and occurs specifically in ToolJet's GitHub Actions workflow for render-preview deployments. GitHub Actions workflow expressions such as ${{ github.event.comment.body }} expand user-supplied content directly into the shell context of a run: step, which is a well-documented class of CI/CD injection. When user-controlled data is interpolated directly into a bash conditional rather than being passed through an environment variable or sanitized, an attacker can inject shell metacharacters to execute arbitrary commands. The affected component is the ToolJet source repository's own CI pipeline, covering all versions identified by CPE cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:* prior to 3.20.180. Secrets such as deployment API keys and tokens present in the runner environment are the primary exfiltration targets.
RemediationAI
Vendor-released patch: 3.20.180. Teams should upgrade to ToolJet 3.20.180 or later immediately, as documented in the GitHub Security Advisory at https://github.com/ToolJet/ToolJet/security/advisories/GHSA-4pm2-w6g5-28mm. For forks or self-hosted CI pipelines using the affected workflow prior to patching, the immediate workaround is to assign github.event.comment.body to an environment variable (e.g., env: COMMENT_BODY: ${{ github.event.comment.body }}) and reference $COMMENT_BODY in the bash step rather than interpolating the expression directly - this prevents shell metacharacter injection at the GitHub Actions expression layer. Additionally, restricting the comment-triggered workflow to verified organization members or required reviewers via github.actor membership checks reduces the attacker population, though this does not eliminate the injection class if untrusted input still reaches the shell. Rotating any secrets accessible to the CI runner environment is advisable if exploitation is suspected.
The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that w
Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0. Rated high severity (CVSS 8.8), this vuln
ToolJet versions v0.5.0 to v1.2.2 are vulnerable to token leakage via Referer header that leads to account takeover . Ra
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. Rated high severity (CVSS 8.0), this vul
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a
Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Rated high severity (CVSS
Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML v
Stored code injection in ToolJet self-hosted (prior to 3.20.178-lts) lets any authenticated builder-role user - availabl
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside t
Just like in the previous report, an attacker could steal the account of different users. Rated medium severity (CVSS 4.
Server-side request forgery in ToolJet's RestAPI data source (versions prior to 3.20.178-lts) allows a low-privileged pl
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today