Summary
githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
A GitHub Actions workflow is vulnerable to command injection through the issue title.
The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run.
Details
The vulnerable workflow is:
.github/workflows/discord-issue.yml
The issue title is directly interpolated into a Bash script:
ISSUE_TITLE="${{ github.event.issue.title || github.event.pull_request.title }}"
Because GitHub Actions expressions are expanded before Bash executes the script, an attacker-controlled issue title containing command substitution syntax can be evaluated by the shell.
In the original workflow, the resulting value is then included in a Discord notification payload:
curl -H "Content-Type: application/json" \
-X POST \
-d "{\"username\": \"GitHub Bot\", \"content\": \"${STATUS} created by **${AUTHOR}**: **${ISSUE_TITLE}**\n🔗 ${ISSUE_URL}\"}" \
"$DISCORD_WEBHOOK"
PoC
For safety, I reproduced this only in my fork. I did not trigger the original repository’s Discord webhook.
I kept the vulnerable Bash assignment unchanged and replaced the Discord webhook request with echo statements to observe the result safely.
Test issue title:
title: $(whoami)
Observed workflow log:
ISSUE_TITLE=title: runner
This confirms that $(whoami) was executed on the GitHub Actions runner before the value would be sent to Discord.
Impact
Any user who can open an issue may be able to execute shell commands on the GitHub Actions runner.
In practice, this means an attacker could create an issue with a crafted title, cause the workflow to execute a shell command, and have the command output included in the Discord notification content. This can be used to manipulate Discord notifications, spoof trusted GitHub bot messages, or repeatedly trigger unwanted notifications.
More importantly, the command runs in a workflow environment where a Discord webhook secret is configured. Depending on repository settings and workflow permissions, this may put workflow secrets or other environment data at risk.
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Do not insert issue titles directly into Bash scripts.
Pass the title through an environment variable instead:
env:
ISSUE_TITLE: ${{ github.event.issue.title }}
run: |
issue_title="$ISSUE_TITLE"
Also avoid eval, unquoted variable expansion, or shell execution patterns involving user-controlled issue content.
Frequently Asked Questions
- What is GHSA-C3XH-98XP-6QHF? GHSA-C3XH-98XP-6QHF is a high-severity OS command injection vulnerability in gouef/githubtoplanguages (actions), affecting versions < 1.1.4. It is fixed in 1.1.4. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- Which versions of gouef/githubtoplanguages are affected by GHSA-C3XH-98XP-6QHF? gouef/githubtoplanguages (actions) versions < 1.1.4 is affected.
- Is there a fix for GHSA-C3XH-98XP-6QHF? Yes. GHSA-C3XH-98XP-6QHF is fixed in 1.1.4. Upgrade to this version or later.
- Is GHSA-C3XH-98XP-6QHF exploitable, and should I be worried? Whether GHSA-C3XH-98XP-6QHF is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-C3XH-98XP-6QHF is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-C3XH-98XP-6QHF? Upgrade
gouef/githubtoplanguagesto 1.1.4 or later.