fix(ci): read PR title from env in auto-version workflow to prevent injection#6074
Merged
KazariEX merged 1 commit intoMay 29, 2026
Merged
Conversation
The Auto Version Bump workflow runs on pull_request (opened) and builds
VERSION="${{ github.event.pull_request.title }}" inside a run block. Actions
expands ${{ ... }} into the script before bash executes, so a PR title like
v3.0.0"; <command>; " is evaluated by the shell. The job is gated on the title
starting with "v3." (which a PR author controls) and the ^v...$ regex check runs
only after the assignment, so it does not prevent the injection.
This passes the title via a PR_TITLE env var and assigns VERSION="$PR_TITLE";
environment values are not re-parsed by the shell. The version regex still
guards what gets passed to lerna. No behavior change for real version titles.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
auto-version workflow to prevent injection
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I do software supply chain security work and was looking through Actions workflows for spots where untrusted input lands in a shell. Small fix for
auto-version.yml.The "Bump version from PR title" step does
VERSION="${{ github.event.pull_request.title }}". Since Actions expands${{ }}into the script text before bash runs, a PR title such asv3.0.0"; id; "gets evaluated as a shell command. ThestartsWith(..., 'v3.')job condition and the^v[0-9]+...$check don't prevent it: the title prefix is attacker-chosen, and the regex runs only after the assignment has already been interpolated.Trigger here is
pull_request(notpull_request_target), so for fork PRs the token is read-only and there are no secrets, which keeps the impact to code execution on the ephemeral runner rather than secret theft. Still worth closing since it is an easy foothold and the job otherwise runs withcontents: write/pull-requests: writefor same-repo PRs.Fix routes the title through a
PR_TITLEenv var and assignsVERSION="$PR_TITLE"; env values aren't re-parsed by the shell, and the version regex still gates what reaches lerna. No change for legitimate version titles.