Understanding and Defending Against Command Injection in conflibot via Crafted Pull Request Branch Names

Overview

conflibot, a GitHub action used for automating workflows, is vulnerable to a critical command injection attack. This vulnerability, identified as CVE-2026-55158, stems from the improper neutralization of special elements in OS commands. Specifically, an attacker can craft a pull request with a malicious branch name that, when processed by conflibot, leads to arbitrary command execution on the runner. This can result in severe consequences, including the exfiltration of secrets, repository compromise, and abuse of the GitHub token's permissions.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability lies in how conflibot constructs and executes Git commands. Prior to version 1.2.1, conflibot uses string interpolation to build Git commands and runs them through a shell. This approach allows an attacker to inject malicious shell metacharacters (such as `` ` ``, `$( )`, `;`, `|`, or `&`) into the branch names of pull requests. Since these branch names are attacker-controlled, anyone can open a pull request with a malicious head branch name. This vulnerability falls under CWE-78, 'Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')'.

Attack Surface & Vector

The attack surface for this vulnerability is particularly broad because it involves the `pull_request_target` event, a configuration that is both recommended and widely used. In this setup, the job has access to the base repository's secrets and a write-scoped `GITHUB_TOKEN`. When a pull request is opened, the action runs automatically without requiring special privileges or maintainer interaction. An attacker can exploit this vulnerability by crafting a pull request with a malicious branch name. The attack vector involves the following preconditions: - The target workflow uses `wktk/conflibot` at a version earlier than 1.2.1. - The workflow is triggered on the `pull_request_target` event.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate Jenkins Instance via conflibot 1. Initial Position: An attacker identifies a GitHub repository using `wktk/conflibot` in a workflow triggered by the `pull_request_target` event. The workflow has access to sensitive secrets and a write-scoped `GITHUB_TOKEN`. 2. Triggering the Flaw: The attacker crafts a pull request from a forked repository with a head branch name containing shell metacharacters designed to inject malicious commands. For example, a branch name like `$(rm -rf /)` could be used. 3. What Breaks: When the pull request is opened, conflibot automatically runs and processes the malicious branch name. Because conflibot builds Git commands using string interpolation and executes them through a shell, the shell metacharacters in the branch name are interpreted, leading to the execution of the injected command. 4. Attacker's Prize: With the ability to execute arbitrary commands on the runner, the attacker can exfiltrate secrets, push malicious changes to the repository, or abuse the permissions of the `GITHUB_TOKEN` to further compromise the environment.

Real-World Impact

The impact of this vulnerability is severe. An attacker can achieve arbitrary command execution on the runner, leading to: - Exfiltration of sensitive secrets and the `GITHUB_TOKEN`. - Unauthorized pushes to the repository. - Lateral movement within the environment if the runner has access to other sensitive systems.

Detection & Defense

Immediate Mitigations

- Upgrade to `wktk/[email protected]` or later. Version 1.2.1 and 2.0.0 fix the vulnerability by using argument arrays via `execFile`/`spawn` instead of a shell, preventing branch names from being interpreted as shell syntax. - For self-hosted runners, ensure Node.js 24 support and Git 2.38 or later are installed.

Detection Strategies

- Monitor workflow runs for unusual or failed executions. - Check repository logs for suspicious pull request activities. - Implement SIEM rules to detect anomalous command executions on runners.

Long-Term Hardening

- Regularly review and update GitHub actions and workflows to use the latest versions. - Implement strict input validation for all user-controlled data, including branch names. - Use defense-in-depth strategies, such as running workflows on isolated environments and limiting the permissions of the `GITHUB_TOKEN`.

Key Takeaways

- Command injection vulnerabilities in GitHub actions can have severe consequences, including arbitrary command execution and secrets exfiltration. - Proper input validation and secure command execution practices are crucial for preventing such attacks. - Regular updates and patches for GitHub actions are essential for mitigating known vulnerabilities. - Defense-in-depth strategies, including isolated environments and limited token permissions, can significantly reduce the risk of exploitation.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-2qvg-qr73-mqxp - CVE-2026-55158: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55158