GHSA-cf8p-vqfr-29v6 - JavaScript injection in CI workflow — unauthenticated issue tracker manipulation via crafted bug report

GitHub Actions workflow test-bug-run-badge.yml in the badges/shields repository.

• Affected Versions: All commits from af7b7f35971493d67a9c1cdfb496c3b11f8a6ffe up to 1f10232 (inclusive).

• Fixed / Patched Versions: Commit d925b814e9aae4a12c3359339d56b8fc73837c41 (and later), where the vulnerable workflow was completely removed.

The test-bug-run-badge.yml GitHub Actions workflow in badges/shields evaluated user-controlled issue body content directly as JavaScript code. An unauthenticated attacker could trigger this workflow by simply opening a bug report, allowing them to exfiltrate the temporary GITHUB_TOKEN (with issues: write scope). This enabled an attacker to manipulate issues and pull requests across the repository, post automated comments, and potentially trigger unauthorized release processes.

• Vulnerability Type: Code Injection / Weakness CWE-94 (Improper Control of Generation of Code)

• Attack Vector: Network (AV:N / AC:L / PR:N / UI:N)

Technical Details

1. Dynamic Expression Evaluation: In the test-bug-run-badge.yml workflow, outputs or issue body content derived from a bug report issue were evaluated directly within inline scripts (such as actions/github-script) without prior sanitization or environment variable encapsulation (e.g., using ${{ needs.extract-bug-badge-url.outputs.link }} directly inside inline JavaScript string templates).

2. Token Exfiltration: When an attacker submitted a specially crafted bug report containing JavaScript payloads, the actions/github-script step executed the payload within the context of the GitHub Actions runner.

3. Impact Scope:

   • Exfiltrated the repository’s GITHUB_TOKEN via automated issue comments.

   • With issues: write permissions, attackers could modify labels, close/reopen/lock issues or PRs, edit titles/bodies, and add release tags.

   • Applying release tags without maintainer awareness could trigger downstream CI/CD deployment pipelines, resulting in unauthorized image pushes to Docker Hub and GHCR.

Remediation

The badges/shields maintainers removed the test-bug-run-badge.yml workflow entirely in commit d925b81. For users wishing to retain similar workflow functionality safely, inputs should be passed into the step via process environment variables (env:) rather than raw expression interpolation (${{ ... }}) in script blocks.