Avivdon

A GitHub Actions workflow used `pull request target` for pre-commit checks on pull requests from forks. This configuration allowed code controlled by a fork to be checked out and executed within a privileged context. The workflow generated and used elevated credentials and could automatically commit or push fixes back to pull request branches, creating a risk of token exposure and providing a write path to the repository if a malicious fork pull request was submitted.

A GitHub Actions script used to prepare tarballs and update GitHub Checks statuses and PR comments was mis-structured. The script mixed code running with higher privileges, specifically a single-use token with write permissions, and untrusted inputs from the PR source branch. This flaw allows a malicious pull request from a fork to extract the `GITHUB TOKEN` value. While the token is valid during the GitHub Actions job execution, it could be used to manipulate Git repository contents, commit checks, statuses, or issue and PR comments based on the assigned permissions.

The render preview deployment workflow interpolates the `github.event.comment.body` variable directly into a bash conditional within a run step. This allows a GitHub user with permission to comment on an open pull request to execute arbitrary shell commands on the CI runner and exfiltrate deployment secrets.

A command injection issue exists in the `dotfiles` registry module where unsanitized user input is passed to shell commands. An attacker can provide a crafted `dotfiles uri` value containing shell command substitution, such as `$(...)`, to execute arbitrary code within a provisioned workspace. This issue is amplified by a `mode=auto` query parameter on the Create Workspace page, which allows the automatic creation of a workspace without user confirmation when combined with `param.*` URL parameters. This enables a one-click attack where an authenticated user clicking a malicious link triggers the creation of a workspace with attacker-controlled parameters, potentially exposing Git credentials, secrets, and workspace files.

A GitHub Actions workflow named 'generate-schema.yaml' exposes sensitive credentials, specifically a Personal Access Token and an SSH signing key, to code controlled by forks. This occurs due to unsafe checkout and credential handling practices.

A GitHub Actions workflow in the `pull-request.yaml` file executes attacker-controlled code from fork pull requests within a privileged context. This allows for the exfiltration of repository secrets, such as Docker Hub credentials and tokens, without requiring approval from a maintainer.

The `entrypoint.sh` script invokes DangerJS from the caller's workspace after copying a fork's checkout into it. This creates an untrusted search path for binary and Node.js module resolution. Consequently, a fork pull request processed by a `pull request target` workflow can lead to the execution of arbitrary code supplied by the fork within the action container, replacing the action's intended code.

Claude Code, an agentic coding tool, contains a bug in the startup trust dialog implementation that allows for code injection. This issue enables the tool to be tricked into executing code within a project before the user has accepted the startup trust dialog. Successful exploitation requires the user to start the application in an untrusted directory.