Medium, CVSS 6.5GitHub ActionsPublished
actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow
GHSA-6p2j-742g-835f
- Affected
- GitHub Actions tiryoh/actions-mkdocs <= 0.24.0
- Fixed in
- 0.25.0· Vendor fix available
- Issue
- External input from github.event.issue.title is used unsafely in a shell command in .github/workflows/release-candidate.yaml, allowing command injection during workflow execution. Details In .github/workflows/release-candidate.yaml, the issue title is interpolated directly into a shell command: Because the issue title is attacker-controlled and is embedded directly into a shell command, shell metacharacters such as command substitution ($()) and command separators (;) can be interpreted by the shell. Although the workflow checks that the title starts with Release , this condition can still be satisfied by a maliciously crafted input. PoC 1. Create or edit an issue with the following title: 2. Trigger the workflow that processes the issue. 3. Observe that the injected command is executed on the runner. The workflow logs show that $(whoami) is evaluated and its output (runner) appears in the command result, confirming that attacker-controlled input is executed within the shell.…
Recommended action: Upgrade to 0.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.