skip to content
Back to
Home Bounties Research Advisories CodeQL Wall of Fame Get Involved Events
February 3, 2021

GHSL-2020-229: Command injection in allenevans/set-env workflow

Jaroslav Lobacevski

Coordinated Disclosure Timeline


The ‘release.yml’ GitHub workflow is vulnerable to arbitrary command injection.


allenevans/set-env GitHub repository

Tested Version



Issue: A commit comment is used to format a shell command

A commit comment is used to format a bash script in step Config:

      - 'master'
        run: |
          echo "Release triggered by ${{}}"
          echo "Commit ${{github.event.commits[0].message}}"

An attacker may put the payload in a commit description and make a valid pull request, that will be merged. It is likely that the reviewer will not notice it, especially if there are multiple commits in the single PR.


This vulnerability allows for arbitrary command injection into the bash script. The attacker may exfiltrate secret tokens to the attacker controlled server, can make arbitrary commit to the repository or subvert the release step directly, that in turn will affect all repositories that depend on the action.


This issue was discovered and reported by GHSL team member @JarLob (Jaroslav Lobačevski).


You can contact the GHSL team at, please include a reference to GHSL-2020-229 in any communication regarding this issue.