Supply Chain
GitHub Actions Script Injection
Also: workflow injection, CI template injection
A CI flaw where attacker-controlled text, like an issue or branch name, is placed straight into a workflow's shell command and runs as code.
In more detail
It happens when a workflow inserts values such as the title of a pull request into a run step using expression syntax. The substitution occurs before the shell parses the line, so quotes and command separators in the title become commands on the runner, which often holds secrets. Pass untrusted values through environment variables, restrict token permissions and lint workflows for the pattern.