{"id":"CVE-2026-105767","aliases":["EUVD-2026-92780","GHSA-vh2r-m6q8-8hp3"],"status":"published","title":"Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00185,"percentile":0.08217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-10-05T19:48:47Z","modified":"2026-11-11T02:48:49Z","products":[{"vendor":"chainguard","product":"chainguard academy (edu)"}],"references":[{"url":"https://github.com/chainguard-dev/edu/commit/fb0efb2537d326ab18c07d620875b8ed2a4b39f3","tags":["patch","fix"]},{"url":"https://github.com/chainguard-dev/edu/pull/3471","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105767","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vh2r-m6q8-8hp3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105767.json","tags":["advisory"]},{"url":"https://github.com/chainguard-dev/edu","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-105767","title":"Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","status":"published","published":"2026-10-05T19:48:47.712Z","modified":"2026-10-06T14:14:31.45Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-92780","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","status":"published","published":"2026-10-05T19:48:47Z","modified":"2026-10-06T14:14:31Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:37.480805Z"}],"ghsa":[{"id":"GHSA-vh2r-m6q8-8hp3","title":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs...","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","status":"published","published":"2026-10-05T21:31:37Z","modified":"2026-10-05T21:31:46Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:12:48.668129Z"}],"nvd":[{"id":"CVE-2026-105767","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","status":"published","published":"2026-10-05T20:17:20.84Z","modified":"2026-10-06T15:17:15.487Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"CVE-2026-105767","title":"Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands","description":"Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps.","status":"published","published":"2026-10-05T19:48:47.712Z","modified":"2026-11-11T10:47:23.427962731Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-78"],"updated_at":"2026-11-11T03:22:00.901153Z"}]}}