Githubtoplanguages
Monthly
Command injection in the GitHub Actions workflow shipped with githubtoplanguages (versions before 1.1.4) lets anyone who can open an issue on a repository running the bundled discord-issue.yml workflow execute arbitrary shell commands on the Actions runner. The issue title is expanded by GitHub Actions directly into a Bash assignment, so a title containing $(...) command-substitution syntax is evaluated by the shell before the value is posted to Discord; a public proof-of-concept was demonstrated by the reporter in a fork. A successful injection can spoof trusted bot notifications and may expose the configured DISCORD_WEBHOOK secret or other workflow environment data, and remediation is available in version 1.1.4 / commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.
Command injection in the GitHub Actions workflow shipped with githubtoplanguages (versions before 1.1.4) lets anyone who can open an issue on a repository running the bundled discord-issue.yml workflow execute arbitrary shell commands on the Actions runner. The issue title is expanded by GitHub Actions directly into a Bash assignment, so a title containing $(...) command-substitution syntax is evaluated by the shell before the value is posted to Discord; a public proof-of-concept was demonstrated by the reporter in a fork. A successful injection can spoof trusted bot notifications and may expose the configured DISCORD_WEBHOOK secret or other workflow environment data, and remediation is available in version 1.1.4 / commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.