CyberRota Analysis
AI-GeneratedA vulnerability exists in the MaaAssistantArknights tool, where attacker-controlled input from pull request titles can be executed as shell commands on the ubuntu-latest runner during specific GitHub workflow events. This could allow an attacker to execute arbitrary commands, potentially compromising the integrity of the system. Organizations using this tool, particularly those leveraging GitHub Actions for CI/CD, should prioritize applying the fix to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull_request.title into a run: shell command during the pull_request opened, reopened, and ready_for_review events, so a non-draft fork PR whose title starts with Release v could execute shell commands on the ubuntu-latest runner during the generate-changelog job. This vulnerability is fixed by commit cafc3946059e6337d2089d4fec8b6885ba17c332.