CyberRota Analysis
AI-GeneratedThe vulnerability affects the integrate-platform-docs composite GitHub Action within Chainguard Academy, allowing an attacker with control over the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner due to improper handling of input interpolation in Bash commands. While the risk is considered low, it is essential for developers using this action to prioritize remediation, especially if their workflows involve untrusted inputs or external contributors. Organizations leveraging GitHub Actions should review their implementations to ensure that sensitive inputs are adequately protected against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.