GCVE-110-OSM-2026-14329

This legitimate repository was targeted in a September 2026 campaign that planted shell command injection payloads in GitHub issues, pull requests or comments. When a CI workflow handles that text unsafely, the payload runs inside the job and sends its environment variables, which can include repository tokens, cloud credentials and deployment secrets, to an attacker-controlled server. Malicious payload found in: unknown (not stated in source; a GitHub issue, pull request or comment) - Trigger: a GitHub Actions workflow that inserts attacker-controlled GitHub text into shell source. Bash performs command substitution on `$(...)` even inside double quotes, so the text runs as code. - Behavior: `env` collects the job's environment variables, `base64 | tr -d '\n'` encodes them, and `curl -s ... -d` POSTs them over plain HTTP (port 8443) to the collection server. The unique ID in the `/c/` path identifies the target. - Impact depends on the job's permissions and secrets. The source did not establish that credentials were obtained or that code was modified.