Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands
Summary
| CVE | CVE-2026-105767 |
|---|---|
| State | PUBLISHED |
| Assigner | chainguard |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-05 20:17:20 UTC |
| Updated | 2026-10-05 20:17:20 UTC |
| Description | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the project_id or storage_bucket inputs to execute arbitrary shell commands on the GitHub Actions runner, because the inputs are interpolated directly into Bash gcloud storage cp commands in several steps via ${{ inputs.* }} expressions. The only in-repository caller passed repository secrets and ran only on trusted triggers, so no untrusted input was known to reach the vulnerable steps. |
Risk And Classification
Primary CVSS: v4.0 2.1 LOW from 82cea9a6-e9e3-46fe-bdb0-3673de380178
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-78 | CWE-78 CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 82cea9a6-e9e3-46fe-bdb0-3673de380178 | Secondary | 2.1 | LOW | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 2.1 | LOW | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | 82cea9a6-e9e3-46fe-bdb0-3673de380178 | Secondary | 3.3 | LOW | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 3.3 | LOW | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Chainguard | Chainguard Academy Edu | affected 7375a80caabcc31c33ec90f29687ed78c13d16ff fb0efb2537d326ab18c07d620875b8ed2a4b39f3 git | GitHub Actions |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/chainguard-dev/edu/commit/fb0efb2537d326ab18c07d620875b8ed2a4... | 82cea9a6-e9e3-46fe-bdb0-3673de380178 | github.com | |
| github.com/chainguard-dev/edu/pull/3471 | 82cea9a6-e9e3-46fe-bdb0-3673de380178 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Steve Beattie (https://github.com/stevebeattie) (en)
CNA: SunnyR (https://github.com/SunnyR) (en)
CNA: Chainguard (https://chainguard.dev) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-01-20T14:42:00.000Z | Action introduced with inline input interpolation (chainguard-dev/edu#227) |
| CNA | 2026-06-26T18:13:00.000Z | Fix merged (chainguard-dev/edu#3471) |
Solutions
CNA: Fixed in commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, which passes the inputs to the shell through environment variables instead of expression interpolation. Workflows that reference this action at an older ref should update to fb0efb2537d326ab18c07d620875b8ed2a4b39f3 or later.