Command Injection Vulnerability in GitHub Actions Workflow for GitHubTopLanguages

CVE-2026-58502

What is CVE-2026-58502?

A command injection vulnerability exists in the GitHubTopLanguages project due to improper handling of issue titles in the GitHub Actions workflow. Specifically, when an issue is opened or closed, the title is directly interpolated into a Bash variable without adequate sanitization. This flaw allows attackers to execute arbitrary shell commands on the GitHub Actions runner. As a result, an attacker could manipulate or spoof notifications sent through Discord, potentially revealing sensitive information such as webhook secrets and other workflow environment variables, depending on the repository's permissions. This vulnerability was addressed in a recent commit to the project.

References