Impact

A command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields (title, body, etc.) were directly interpolated into shell commands in a run: block. An attacker could craft a malicious GitHub Discussion title or body (e.g., $(curl ...)) to execute arbitrary shell commands on the Actions runner.

This could result in:

• Exfiltration of the repository’s GITHUB_TOKEN (with write access),
• Unauthorized changes to repository contents, releases, and workflows,
• Exposure of other repository secrets (e.g., Slack, npm tokens).

Patches

The vulnerable workflow (discussion-to-slack.yml) was deleted. A secure replacement will be added with sanitized handling of untrusted inputs and reduced token permissions.

Workarounds

Users should remove the discussion-to-slack.yml workflow if using a fork or derivative of this repository. If you adapted this pattern elsewhere, ensure that user input is never interpolated directly into shell scripts — use environment variables or safe output blocks instead.

References

• GitHub Actions security best practices
• Command injection in GitHub Actions