PT-2026-28615 · Unknown+1 · Njzjz/Wenxian+1
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
wenxian versions 0.3.1 and earlier
Description
wenxian is a tool used to generate BIBTEX files from identifiers such as DOI, PMID, arXiv ID, or paper titles. A GitHub Actions workflow in the software uses untrusted user input from the
issue comment.body variable directly within a shell command. Because the input is interpolated without sanitization, it allows for command injection, enabling remote attackers to execute arbitrary code on the runner. This could lead to the compromise of the CI/CD pipeline, exfiltration of repository data, and unauthorized access to the GITHUB TOKEN.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Avoid directly interpolating untrusted user input into shell commands by passing
issue comment.body through an environment variable and referencing it safely within the script.Exploit
RCE
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github Actions
Njzjz/Wenxian