Improper Neutralization in Chainguard Academy's GitHub Action
CVE-2026-105767

2.1LOW

Key Information:

Vendor

Chainguard

Status
Chainguard Academy (edu)
Vendor
CVE Published:
5 October 2026

What is CVE-2026-105767?

The integrate-platform-docs composite GitHub Action within Chainguard Academy has a vulnerability that allows project_id or storage_bucket inputs to execute arbitrary shell commands. This stems from improper interpolation of these inputs into Bash commands in several steps. Although the repository secrets were used securely with trusted triggers, the potential exploited input could lead to unauthorized command execution on the GitHub Actions runner.

Affected Version(s)

Chainguard Academy (edu) GitHub Actions 7375a80caabcc31c33ec90f29687ed78c13d16ff

References

https://github.com/chainguard-dev/edu/commit/fb0efb2537d3...
patch
https://github.com/chainguard-dev/edu/pull/3471
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Steve Beattie (https://github.com/stevebeattie)
SunnyR (https://github.com/SunnyR)
Chainguard (https://chainguard.dev)
.