The workflow ran each time somebody opened a GitHub situation and used the problem title as a part of a shell command. A change launched in PR#1218 altered the best way this enter was dealt with, permitting an attacker to inject and execute their very own instructions by way of the workflow, the researchers defined.
The workflow additionally contained a safety designed to stop exploitation by untrusted customers. However that examine was ineffective as a result of it was constructed for a pull request, however the exploit concerned dealing with “points”. Consequently, the examine didn’t work as meant, permitting any GitHub person to get previous it.
The vulnerability went reside on June 18, when PR#1218 was merged. Wiz stated GitHub Superior Safety had scanned the ultimate revision and extracted the susceptible workflow however did not flag the injection.
