Repository navigation
Security issue: possible command injection in GitHub Actions workflow #1
Description
Hello maintainers,
I would like to report a potential command-injection vulnerability in your GitHub Actions workflow.
The affected workflow file(s) invoke an LLM to process and summarize issues, and then directly concatenate the LLM output into a shell command argument for gh issue comment --body. Because untrusted model output is inserted into a shell command context, an attacker may craft a malicious issue so that the LLM response contains an injection payload.
Impact:
- Possible command injection during workflow execution.
- Possible leakage of sensitive environment variables (for example
GITHUB_TOKENorGH_TOKEN). - Although these tokens are typically short-lived and scoped to workflow job/step execution, an attacker may attempt to prolong execution time (for example via sleep-based techniques) and abuse the token during that window.
Recommended remediation:
- Do not place
${{ steps.inference.outputs.response }}directly in a shell command argument. - Pass it through a step environment variable first (for example
RESPONSE). - In shell, reference it only as a double-quoted variable (for example
"$RESPONSE").
Affected workflow file(s) observed:
Thank you for your time and for maintaining this project.
Activity
github-actions commentedon Mar 5, 2026
This GitHub issue reports a potential command injection vulnerability in a workflow that uses an LLM (large language model) to process and summarize issues, where the generated output is directly included in a command-line argument for
gh issue comment --body. The concern is that an attacker could craft a malicious input to produce an injection payload in the LLM response, potentially allowing them to execute arbitrary commands. This creates risks such as command injection during workflow execution and possible exposure of sensitive tokens (e.g.,GITHUB_TOKEN). The issue recommends mitigating the vulnerability by assigning the LLM output to an environment variable and referencing it securely in a double-quoted context within shell scripts. The affected workflow file is identified as.github/workflows/summary.ymlin the repository.github-actions commentedon Mar 5, 2026
Message that will be displayed on users' first issue