Workflow inlines user input into a shell script

📋 What is this?

A run: step inlines a ${{ github.event.* }} template expression directly into a shell command. The expression value is interpolated by GitHub *before* the shell parses it, so a malicious PR title becomes part of the executed script.

⚠️ Impact

🔧 How to fix

Bind the untrusted value to an env: variable first, then reference the env var from the shell. The shell quotes env-var expansion naturally, breaking the injection.

# .github/workflows/welcome.yml — ❌ Template injection
on: pull_request_target
jobs:
  welcome:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Welcome ${{ github.event.pull_request.title }}!"

# .github/workflows/welcome.yml — ✅ Bind through env:
on: pull_request_target
jobs:
  welcome:
    runs-on: ubuntu-latest
    steps:
      - env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: echo "Welcome $PR_TITLE!"

# .plumber.yaml
github:
  controls:
    workflowMustNotInlineUserInputIntoShell:
      enabled: true

💡 Tips

• The dangerous fields are github.event.pull_request.*, github.event.issue.*, github.event.comment.*, github.head_ref, and github.event.commits[*].message.
• github.repository, github.sha, and github.ref_name are derived from server-trusted state — safer but still worth scoping.
• Pair with ISSUE-802 to also catch the trigger side of the same attack.

⚙️ Configuration

This control is configured in .plumber.yaml under the github section:

github:
  controls:
    workflowMustNotInjectUserInputInScripts:
      enabled: true

See the CLI documentation for the full configuration reference.

🔗 Related issues