Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

gouef/githubtoplanguages

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1GitHub ActionsPublished

    githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

    GHSA-c3xh-98xp-6qhf

    Affected
    • GitHub Actions gouef/githubtoplanguages < 1.1.4
    Fixed in
    1.1.4· Vendor fix available
    Issue
    A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run. Details The vulnerable workflow is: .github/workflows/discord-issue.yml The issue title is directly interpolated into a Bash script: Because GitHub Actions expressions are expanded before Bash executes the script, an attacker-controlled issue title containing command substitution syntax can be evaluated by the shell. In the original workflow, the resulting value is then included in a Discord notification payload: PoC For safety, I reproduced this only in my fork. I did not trigger the original repository’s Discord webhook. I kept the vulnerable Bash assignment unchanged and replaced the Discord webhook request with echo statements to observe the result…

    Recommended action: Upgrade to 1.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →