Command Injection Flaw in gluestack-ui Library by GlueStack

CVE-2025-53104

What is CVE-2025-53104?

A command injection vulnerability was identified in the gluestack-ui library's GitHub Actions workflow, specifically in the discussion-to-slack.yml configuration. This flaw allows untrusted user input, from fields like discussion titles and bodies, to be interpolated into shell commands. Malicious actors could exploit this by crafting targeted GitHub Discussion content to execute arbitrary commands on the Actions runner, leading to potential unauthorized access or control. The issue has since been mitigated by the removal of the vulnerable workflow in commit e6b4271, and users are advised to delete the discussion-to-slack.yml workflow if they utilize any forks or derivatives of this repository.

References