Security issue: possible command injection in GitHub Actions workflow #20
Description
Hello maintainers,
I would like to report a potential command-injection vulnerability in your GitHub Actions workflow.
The affected workflow file(s) invoke an LLM to process and summarize issues, and then directly concatenate the LLM output into a shell command argument for gh issue comment --body. Because untrusted model output is inserted into a shell command context, an attacker may craft a malicious issue so that the LLM response contains an injection payload.
Impact:
- Possible command injection during workflow execution.
- Possible leakage of sensitive environment variables (for example
GITHUB_TOKENorGH_TOKEN). - Although these tokens are typically short-lived and scoped to workflow job/step execution, an attacker may attempt to prolong execution time (for example via sleep-based techniques) and abuse the token during that window.
Recommended remediation:
- Do not place
${{ steps.inference.outputs.response }}directly in a shell command argument. - Pass it through a step environment variable first (for example
RESPONSE). - In shell, reference it only as a double-quoted variable (for example
"$RESPONSE").
Affected workflow file(s) observed:
Thank you for your time and for maintaining this project.
Activity
github-actions commentedon Mar 5, 2026
A potential command injection vulnerability has been identified in a GitHub Actions workflow of the repository. The issue stems from the workflow invoking a language model (LLM) to process and summarize issues, then directly embedding the LLM output into a shell command argument for
gh issue comment --body. This practice allows for untrusted model-generated content to be executed in a shell command context, enabling attackers to craft malicious issues that could inject harmful payloads into the command.The impact of this vulnerability includes the risk of command injection during workflow execution and possible leakage of sensitive environment variables, such as
GITHUB_TOKENorGH_TOKEN. These tokens, typically short-lived and scoped to workflow jobs or steps, could be exploited by attackers using techniques such as prolonged execution times to abuse the tokens during their validity period. Such exploitation could have significant security ramifications.As remediation, it is recommended to avoid directly embedding the LLM output (
${{ steps.inference.outputs.response }}) in shell commands. Instead,