CVE-2026-6145: Gh Actions Untrusted Run Interpolation
Direct string interpolation of untrusted GitHub context values into a 'run' step can lead to command injection. An attacker could control these context values (such as github.ref, github.event) and inject shell metacharacters. Bind data to an intermediate environment variable and use the variable in the script instead.
YAMLgreprules fetch cve-2026-6145-gh-actions-untrusted-run-interpolation --engine opengrepDescription
Direct string interpolation of untrusted GitHub context values into a 'run' step can lead to command injection. An attacker could control these context values (such as github.ref, github.event) and inject shell metacharacters. Bind data to an intermediate environment variable and use the variable in the script instead.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.