{"id":"CVE-2026-58502","aliases":["EUVD-2026-78911","GHSA-c3xh-98xp-6qhf"],"status":"published","title":"githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow","description":"githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00531,"percentile":0.45258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-06-19T22:10:31Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"GitHub Actions","package":"gouef/githubtoplanguages","fixed_in":["1.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"GitHub Actions","package":"gouef/githubtoplanguages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}]},{"source":"osv","ecosystem":"GitHub Actions","package":"gouef/githubtoplanguages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.4"}]}]}],"products":[{"vendor":"gouef","product":"githubtoplanguages"}],"references":[{"url":"https://github.com/gouef/githubtoplanguages/security/advisories/GHSA-c3xh-98xp-6qhf","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/gouef/githubtoplanguages/commit/6bf9c3a9cb66c937b9047ca266b3d02f2bb11027","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/gouef/githubtoplanguages/commit/157840482e592bd4f8e0617539e73cdbef26f1ac","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c3xh-98xp-6qhf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58502.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58502","tags":["advisory"]},{"url":"https://github.com/gouef/githubtoplanguages","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-58502","title":"githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow","description":"githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.","status":"published","published":"2026-09-15T17:37:34.738Z","modified":"2026-09-17T16:37:42.953Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-78911","description":"githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.","status":"published","published":"2026-09-15T17:37:34Z","modified":"2026-09-17T16:37:42Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:11.273554Z"}],"ghsa":[{"id":"GHSA-c3xh-98xp-6qhf","title":"githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow","description":"### Summary\n\nA GitHub Actions workflow is vulnerable to command injection through the issue title.\n\nThe workflow is triggered when an issue is opened or closed, and it directly inserts `github.event.issue.title` into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run.\n\n\n### Details\n\nThe vulnerable workflow is:\n\n`.github/workflows/discord-issue.yml`\n\nThe issue title is directly interpolated into a Bash script:\n\n```bash\nISSUE_TITLE=\"${{ github.event.issue.title || github.event.pull_request.title }}\"\n```\n\nBecause GitHub Actions expressions are expanded before Bash executes the script, an attacker-controlled issue title containing command substitution syntax can be evaluated by the shell.\n\nIn the original workflow, the resulting value is then included in a Discord notification payload:\n\n```bash\ncurl -H \"Content-Type: application/json\" \\\n  -X POST \\\n  -d \"{\\\"username\\\": \\\"GitHub Bot\\\", \\\"content\\\": \\\"${STATUS} created by **${AUTHOR}**: **${ISSUE_TITLE}**\\n🔗 ${ISSUE_URL}\\\"}\" \\\n  \"$DISCORD_WEBHOOK\"\n```\n\n### PoC\n\nFor safety, I reproduced this only in my fork. I did not trigger the original repository’s Discord webhook.\n\nI kept the vulnerable Bash assignment unchanged and replaced the Discord webhook request with `echo` statements to observe the result safely.\n\nTest issue title:\n\n```text\ntitle: $(whoami)\n```\n\nObserved workflow log:\n\n```text\nISSUE_TITLE=title: runner\n```\n\nThis confirms that `$(whoami)` was executed on the GitHub Actions runner before the value would be sent to Discord.\n\n### Impact\n\nAny user who can open an issue may be able to execute shell commands on the GitHub Actions runner.\n\nIn practice, this means an attacker could create an issue with a crafted title, cause the workflow to execute a shell command, and have the command output included in the Discord notification content. This can be used to manipulate Discord notifications, spoof trusted GitHub bot messages, or repeatedly trigger unwanted notifications.\n\nMore importantly, the command runs in a workflow environment where a Discord webhook secret is configured. Depending on repository settings and workflow permissions, this may put workflow secrets or other environment data at risk.\n\n### Suggested Fix\n\nDo not insert issue titles directly into Bash scripts.\n\nPass the title through an environment variable instead:\n\n```yaml\nenv:\n  ISSUE_TITLE: ${{ github.event.issue.title }}\nrun: |\n  issue_title=\"$ISSUE_TITLE\"\n```\n\nAlso avoid `eval`, unquoted variable expansion, or shell execution patterns involving user-controlled issue content.","status":"published","published":"2026-06-19T22:10:31Z","modified":"2026-06-19T22:10:33Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-58502","description":"githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.","status":"published","published":"2026-09-15T18:17:26.193Z","modified":"2026-09-30T17:51:56.193Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-58502","title":"githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow","description":"githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.","status":"published","published":"2026-09-15T17:37:34.738Z","modified":"2026-10-28T02:30:35.859158133Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-c3xh-98xp-6qhf","title":"githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow","description":"### Summary\n\nA GitHub Actions workflow is vulnerable to command injection through the issue title.\n\nThe workflow is triggered when an issue is opened or closed, and it directly inserts `github.event.issue.title` into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run.\n\n\n### Details\n\nThe vulnerable workflow is:\n\n`.github/workflows/discord-issue.yml`\n\nThe issue title is directly interpolated into a Bash script:\n\n```bash\nISSUE_TITLE=\"${{ github.event.issue.title || github.event.pull_request.title }}\"\n```\n\nBecause GitHub Actions expressions are expanded before Bash executes the script, an attacker-controlled issue title containing command substitution syntax can be evaluated by the shell.\n\nIn the original workflow, the resulting value is then included in a Discord notification payload:\n\n```bash\ncurl -H \"Content-Type: application/json\" \\\n  -X POST \\\n  -d \"{\\\"username\\\": \\\"GitHub Bot\\\", \\\"content\\\": \\\"${STATUS} created by **${AUTHOR}**: **${ISSUE_TITLE}**\\n🔗 ${ISSUE_URL}\\\"}\" \\\n  \"$DISCORD_WEBHOOK\"\n```\n\n### PoC\n\nFor safety, I reproduced this only in my fork. I did not trigger the original repository’s Discord webhook.\n\nI kept the vulnerable Bash assignment unchanged and replaced the Discord webhook request with `echo` statements to observe the result safely.\n\nTest issue title:\n\n```text\ntitle: $(whoami)\n```\n\nObserved workflow log:\n\n```text\nISSUE_TITLE=title: runner\n```\n\nThis confirms that `$(whoami)` was executed on the GitHub Actions runner before the value would be sent to Discord.\n\n### Impact\n\nAny user who can open an issue may be able to execute shell commands on the GitHub Actions runner.\n\nIn practice, this means an attacker could create an issue with a crafted title, cause the workflow to execute a shell command, and have the command output included in the Discord notification content. This can be used to manipulate Discord notifications, spoof trusted GitHub bot messages, or repeatedly trigger unwanted notifications.\n\nMore importantly, the command runs in a workflow environment where a Discord webhook secret is configured. Depending on repository settings and workflow permissions, this may put workflow secrets or other environment data at risk.\n\n### Suggested Fix\n\nDo not insert issue titles directly into Bash scripts.\n\nPass the title through an environment variable instead:\n\n```yaml\nenv:\n  ISSUE_TITLE: ${{ github.event.issue.title }}\nrun: |\n  issue_title=\"$ISSUE_TITLE\"\n```\n\nAlso avoid `eval`, unquoted variable expansion, or shell execution patterns involving user-controlled issue content.","status":"published","published":"2026-06-19T22:10:31Z","modified":"2026-09-17T03:56:02.357902455Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}