CVE-2026-58502

The githubtoplanguages project's .github/workflows/discord-issue.yml workflow interpolates the untrusted github.event.issue.title value directly into a Bash variable assignment (ISSUE_TITLE) before the shell parses it, allowing anyone who can open or close an issue on the repository to embed shell command-substitution syntax and execute arbitrary commands on the GitHub Actions runner. Successful exploitation lets the attacker run commands in the workflow context, which can manipulate or spoof the trusted Discord bot notification and potentially read the DISCORD_WEBHOOK secret or other workflow environment data depending on repository permissions. Only repositories that carry this vulnerable workflow (the project's own repository and any forks that retained it before the fix) are affected, and the flaw is patched by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027. The vulnerability is rated high severity (CVSS 4.0: 7.1) but is not in the CISA KEV catalog and no public proof of concept or observed exploitation is known.

What to do: Pull in the fix commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027 or later if you maintain a fork or template using this workflow. As a general mitigation, never interpolate untrusted event fields (like issue titles) directly into run: scripts — pass them through the workflow env: block and reference them as shell environment variables instead. If the workflow previously ran on issues from untrusted users, review GitHub Actions run logs for command-substitution in issue titles and rotate the DISCORD_WEBHOOK secret.