Improper Control of Generation of Code (‘Code Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-94: Improper Control of Generation of Code (‘Code Injection’) |
| OWASP | A03:2021 - Injection |
| Confidence Level | High |
| Impact Level | High |
| Likelihood Level | High |
Description#
Directly using ${{ github.* }} variables from the GitHub context in the script: field of actions/github-script can allow untrusted user input to be executed as code. This exposes your workflow to code injection attacks.
Impact#
An attacker could inject malicious code into the GitHub Actions runner, potentially stealing secrets, modifying your repository, or accessing sensitive data. This can result in compromised credentials, unauthorized repository changes, and broader security breaches in your CI/CD pipeline.