ZeroDay Findings
Sign inSign up

Findings

CVE-2026-58502

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

Published Jun 19, 2026 · corrected/updated Sep 17, 2026 · evidence confidence high

### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run. ### Details The vulnerable workflow is: The issue title is directly interpolated into a Bash script: Because GitHub Actions expressions are expanded before Bash executes the script, an attacker-controlled issue title containing command substitution syntax can be evaluated by the shell. In the original workflow, the resulting value is then included in a Discord notification payload: ### PoC For safety, I reproduced this only in my fork. I did not trigger the original repository’s Discord webhook. I kept the vulnerable Bash assignment unchanged and replaced the Discord webhook request with statements to observe the result safely. Test issue title: Observed workflow log: This confirms that was executed on the GitHub Actions runner before the value would be sent to Discord. ### Impact Any user who can open an issue may be able to execute shell commands on the GitHub Actions runner. In practice, this means an attacker could create an issue with a crafted title, cause the workflow to execute a shell command, and have the command output included in the Discord notification content. This can be used to manipulate Discord notifications, spoof trusted GitHub bot messages, or repeatedly trigger unwanted notifications. More importantly, the command runs in a workflow environment where a Discord webhook secret is configured. Depending on repository settings and workflow permissions, this may put workflow secrets or other environment data at risk. ### Suggested Fix Do not insert issue titles directly into Bash scripts. Pass the title through an environment variable instead: Also avoid , unquoted variable expansion, or shell execution patterns involving user-controlled is

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-58502 is a high public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: gouef/githubtoplanguages (0 → 1.1.4). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: no CVSS/EPSS yet. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-78. Sources contributing to this record: cve_org, github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 19, 2026 · GitHub Advisory Database

    Detected

    ### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run. ### Details The vulnerable workflow is: The issue title is directly interpolated into

  2. Sep 17, 2026 · GitHub Advisory Database

    Fix available

    gouef/githubtoplanguages fixed in 1.1.4

  3. Sep 17, 2026 · GitHub Advisory Database

    Fix available

    gouef/githubtoplanguages fixed in 1.1.4

  4. Sep 17, 2026 · GitHub Advisory Database

    Updated

    ### Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts into a Bash variable assignment. If an issue title contains command substitution syntax, Bash evaluates it during the workflow run. ### Details The vulnerable workflow is: The issue title is directly interpolated into

Affected

  • GitHub Actions gouef/githubtoplanguages0 → 1.1.4

Sources

References