{"id":"CVE-2026-34243","aliases":["EUVD-2026-17522","GHSA-r4fj-r33x-8v88"],"status":"published","title":"wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`","description":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0221,"percentile":0.82828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20","CWE-77","CWE-78"],"published":"2026-03-29T15:39:56Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"pocgithub","id":"pvharmo2/gha-lab-85f022290a","title":"pvharmo2/gha-lab-85f022290a","date":"2026-09-05","url":"https://github.com/pvharmo2/gha-lab-85f022290a"}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"njzjz/wenxian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.1"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"njzjz/wenxian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.1"}]}]}],"products":[{"vendor":"njzjz","product":"wenxian"}],"references":[{"url":"https://github.com/njzjz/wenxian/security/advisories/GHSA-r4fj-r33x-8v88","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4fj-r33x-8v88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34243.json","tags":["advisory"]},{"url":"https://github.com/njzjz/wenxian","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34243","title":"wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`","description":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T15:49:27.333Z","modified":"2026-04-02T15:21:36.168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-17522","description":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T15:49:27Z","modified":"2026-04-02T15:21:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:22.606516Z"}],"ghsa":[{"id":"GHSA-r4fj-r33x-8v88","title":"wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` ","description":"#### Summary\n\nA GitHub Actions workflow uses untrusted user input from `issue_comment.body` directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner.\n\n#### Details\n\nThe workflow is triggered by `issue_comment`, which can be controlled by external users.\nIn the following step:\n\n```bash\necho identifiers=$(echo \"${{ github.event.comment.body }}\" | grep -oE '@njzjz-bot .*' | head -n1 | cut -c12- | xargs) \u003e\u003e $GITHUB_OUTPUT\n```\n\nthe value of `github.event.comment.body` is directly interpolated into a shell command inside `run:`.\n\nSince GitHub Actions evaluates `${{ }}` before execution, attacker-controlled input is injected into the shell context without sanitization. This creates a command injection risk.\n\nAdditionally, the extracted value is later reused in another step that constructs output using backticks:\n\n```bash\necho '@${{ github.event.comment.user.login }} Here is the BibTeX entry for `${{ steps.extract-identifiers.outputs.identifiers }}`:'\n```\n\nwhich may further propagate unsafe content.\n\n#### PoC\n\n1. Go to an issue in the repository\n2. Post a comment such as:\n\n`@njzjz-bot paper123\" ) ; whoami ; #\n`\n\n3. Observe whether the command is executed or reflected in logs/output\n\u003cimg width=\"658\" height=\"203\" alt=\"poc\" src=\"https://github.com/user-attachments/assets/084ac264-8cb9-4721-8279-26a1da9b891f\" /\u003e\n\nThe injected payload successfully breaks out of the quoted context and executes arbitrary shell commands.\n\nAs shown in the workflow logs, the injected `whoami` command is executed, and the output (`runner`) is printed. This confirms that attacker-controlled input from `github.event.comment.body` is interpreted as shell commands.\n\nThis demonstrates a clear command injection vulnerability in the workflow.\n\n#### Impact\n\n* Remote attackers can inject arbitrary shell commands via issue comments\n* Potential impacts:\n\n  * Execution of arbitrary commands in GitHub Actions runner\n  * Access to `GITHUB_TOKEN`\n  * Exfiltration of repository data\n  * CI/CD pipeline compromise\n\n\nThis issue affects all current versions of the repository as the vulnerable workflow is present in the main branch.\n\n### Suggested Fix\n\nAvoid directly interpolating untrusted user input into shell commands.\n\nInstead, pass `github.event.comment.body` through an environment variable and reference it safely within the script:\n\n```yaml\n- name: Extract identifiers\n  id: extract-identifiers\n  env:\n    COMMENT_BODY: ${{ github.event.comment.body }}\n  run: |\n    identifiers=$(echo \"$COMMENT_BODY\" | grep -oE '@njzjz-bot .*' | head -n1 | cut -c12- | xargs)\n    echo \"identifiers=$identifiers\" \u003e\u003e $GITHUB_OUTPUT","status":"published","published":"2026-03-29T15:39:56Z","modified":"2026-03-31T18:54:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-77","CWE-78"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2026-34243","description":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T16:16:33.253Z","modified":"2026-07-24T20:10:00.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-34243","title":"wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body`","description":"wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.","status":"published","published":"2026-03-31T15:49:27.333Z","modified":"2026-10-28T02:31:14.600162866Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-r4fj-r33x-8v88","title":"wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` ","description":"#### Summary\n\nA GitHub Actions workflow uses untrusted user input from `issue_comment.body` directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner.\n\n#### Details\n\nThe workflow is triggered by `issue_comment`, which can be controlled by external users.\nIn the following step:\n\n```bash\necho identifiers=$(echo \"${{ github.event.comment.body }}\" | grep -oE '@njzjz-bot .*' | head -n1 | cut -c12- | xargs) \u003e\u003e $GITHUB_OUTPUT\n```\n\nthe value of `github.event.comment.body` is directly interpolated into a shell command inside `run:`.\n\nSince GitHub Actions evaluates `${{ }}` before execution, attacker-controlled input is injected into the shell context without sanitization. This creates a command injection risk.\n\nAdditionally, the extracted value is later reused in another step that constructs output using backticks:\n\n```bash\necho '@${{ github.event.comment.user.login }} Here is the BibTeX entry for `${{ steps.extract-identifiers.outputs.identifiers }}`:'\n```\n\nwhich may further propagate unsafe content.\n\n#### PoC\n\n1. Go to an issue in the repository\n2. Post a comment such as:\n\n`@njzjz-bot paper123\" ) ; whoami ; #\n`\n\n3. Observe whether the command is executed or reflected in logs/output\n\u003cimg width=\"658\" height=\"203\" alt=\"poc\" src=\"https://github.com/user-attachments/assets/084ac264-8cb9-4721-8279-26a1da9b891f\" /\u003e\n\nThe injected payload successfully breaks out of the quoted context and executes arbitrary shell commands.\n\nAs shown in the workflow logs, the injected `whoami` command is executed, and the output (`runner`) is printed. This confirms that attacker-controlled input from `github.event.comment.body` is interpreted as shell commands.\n\nThis demonstrates a clear command injection vulnerability in the workflow.\n\n#### Impact\n\n* Remote attackers can inject arbitrary shell commands via issue comments\n* Potential impacts:\n\n  * Execution of arbitrary commands in GitHub Actions runner\n  * Access to `GITHUB_TOKEN`\n  * Exfiltration of repository data\n  * CI/CD pipeline compromise\n\n\nThis issue affects all current versions of the repository as the vulnerable workflow is present in the main branch.\n\n### Suggested Fix\n\nAvoid directly interpolating untrusted user input into shell commands.\n\nInstead, pass `github.event.comment.body` through an environment variable and reference it safely within the script:\n\n```yaml\n- name: Extract identifiers\n  id: extract-identifiers\n  env:\n    COMMENT_BODY: ${{ github.event.comment.body }}\n  run: |\n    identifiers=$(echo \"$COMMENT_BODY\" | grep -oE '@njzjz-bot .*' | head -n1 | cut -c12- | xargs)\n    echo \"identifiers=$identifiers\" \u003e\u003e $GITHUB_OUTPUT","status":"published","published":"2026-03-29T15:39:56Z","modified":"2026-03-31T19:04:50.415845Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}