StatewardStateward
← All vulnerabilities
HIGHSupply chaincurated

SC-GHA-SCRIPT-INJECTION-2020

CI/CD · GitHub Actions · GitHub Actions workflows

Summary

GitHub Security Lab documented (initial guidance August 20, 2020, updated since) a widespread GitHub Actions vulnerability class in which attacker-controlled event fields interpolated into run shell steps cause command execution. Because expressions in double-brace syntax are evaluated and substituted into the temporary shell script before the runner executes it, embedding an untrusted field such as github.event.issue.title or github.event.pull_request.head_ref directly in a run block lets the attacker break out of the intended command. An attacker who simply opens an issue or PR with a title containing a quote and a shell payload (for example a backtick command-substitution or a semicolon-curl sequence) executes arbitrary commands on the runner, reading environment variables and exfiltrating GITHUB_TOKEN and repository secrets to an external host. This is expression/script injection via untrusted github.event input, found across a large number of public-repo workflows. The fix is to never interpolate untrusted context into a shell; pass it through an intermediate quoted environment variable so it is treated as data, not script.

How to avoid it in your code

  • Never interpolate github.event.* directly into run shells; assign it to an env variable and reference it quoted.
  • Treat all github.event fields ending in title, body, ref, head_ref, name, label, message, or email as untrusted input.
  • Set GITHUB_TOKEN permissions to read-only by default and grant write scopes only on the specific jobs that need them.
  • Run static analysis (CodeQL, zizmor) on workflow files to catch expression-injection sinks before merge.
  • Move logic that handles untrusted input into a pinned action or script that takes arguments, not inline templated shell.

References

Related vulnerabilities

All Supply chain →