Zennoxa Shield
Rules / CI/CD
SHIELD-CI-002

GitHub Actions script injection via untrusted event input

highCI/CDCWE-94CVSS 8.1

What it detects

Interpolating an attacker-controlled event field (issue/PR title or body, comment/review body, commit message) directly into a workflow expression lets an attacker inject shell/script when it reaches a run: step — the classic pwn-request script-injection. Use an intermediate env: var and reference it as "$VAR", or an actions/github-script args object.

How to fix

Never inline untrusted event fields into an expression. Assign to an env var (env: TITLE: ${{ github.event.issue.title }}) and use "$TITLE" in run:, quoted.

Vulnerable — Shield flags this.github/workflows/triage.yml
name: Issue triage
on:
  issues:
    types: [opened]
jobs:
  greet:
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "New issue: ${{ github.event.issue.title }}"
Fixed — scans clean.github/workflows/triage.yml
name: Issue triage
on:
  issues:
    types: [opened]
jobs:
  greet:
    runs-on: ubuntu-latest
    steps:
      - run: |
          TITLE=$(jq -r '.issue.title' "$GITHUB_EVENT_PATH")
          echo "New issue: $TITLE"

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CI-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CI-002: GitHub Actions script injection via untrusted event input — Zennoxa Shield