Repository navigation
Security issue: possible command injection in GitHub Actions workflow #83
Description
Hello maintainers,
I would like to report a potential command-injection vulnerability in your GitHub Actions workflow.
The affected workflow file(s) invoke an LLM to process and summarize issues, and then directly concatenate the LLM output into a shell command argument for gh issue comment --body. Because untrusted model output is inserted into a shell command context, an attacker may craft a malicious issue so that the LLM response contains an injection payload.
Impact:
- Possible command injection during workflow execution.
- Possible leakage of sensitive environment variables (for example
GITHUB_TOKENorGH_TOKEN). - Although these tokens are typically short-lived and scoped to workflow job/step execution, an attacker may attempt to prolong execution time (for example via sleep-based techniques) and abuse the token during that window.
Recommended remediation:
- Do not place
${{ steps.inference.outputs.response }}directly in a shell command argument. - Pass it through a step environment variable first (for example
RESPONSE). - In shell, reference it only as a double-quoted variable (for example
"$RESPONSE").
Affected workflow file(s) observed:
Thank you for your time and for maintaining this project.
Activity
github-actions commentedon Mar 5, 2026
A GitHub user has reported a potential command injection vulnerability in a GitHub Actions workflow that processes and summarizes issues using an LLM (Large Language Model). The issue stems from directly inserting untrusted LLM outputs into a shell command argument for
gh issue comment --body, which could allow an attacker to craft a malicious issue and inject commands during workflow execution. This vulnerability poses risks such as potential leakage of sensitive tokens likeGITHUB_TOKENand abuse through prolonged execution techniques. To mitigate this issue, the report recommends using environment variables to handle the LLM output and referencing them securely in shell commands using double quotes. The user specifically identified the affected workflow file within the repository and provided a link for reference.github-actions commentedon Mar 5, 2026
👋 Hi there, and welcome!
Thanks for opening your first issue 😊
Feel free to share as much context as you can — what you were trying to do, what happened, and what you expected.
The more details, the easier it is for us to help!
fwerkor commentedon Mar 18, 2026
Thank you for your reminder! We will deal with it immediately.
fwerkor commentedon Mar 21, 2026
Fixed