CVE-2026-27938: WPGraphQL GitHub Actions RCE Vulnerability

CVE-2026-27938 Overview

CVE-2026-27938 is a command injection vulnerability affecting the WPGraphQL WordPress plugin repository's GitHub Actions workflow. The vulnerability exists in the release.yml workflow file, which improperly handles the pull request body content by injecting it directly into a shell command without proper sanitization. When a pull request is merged from the develop branch to master, an attacker with the ability to create pull requests can execute arbitrary commands on the GitHub Actions runner by crafting a malicious PR body.

Critical Impact

Attackers with pull request access can achieve remote code execution on GitHub Actions runners, potentially compromising CI/CD pipelines, stealing secrets, and tampering with software releases.

Affected Products

• WPGraphQL versions prior to 2.9.1
• GitHub Actions workflows using vulnerable release.yml configuration
• WordPress sites using affected WPGraphQL plugin builds

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27938 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27938

Vulnerability Analysis

This vulnerability represents a classic GitHub Actions expression injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The vulnerable workflow uses the expression ${{ github.event.pull_request.body }} directly within a run: shell block, which causes the PR body content to be interpolated into the shell script before execution.

GitHub Actions context expressions like github.event.pull_request.body are expanded at workflow parse time, meaning any shell metacharacters or command sequences in the PR body are passed directly to the shell interpreter. This allows an attacker to break out of the intended command structure and execute arbitrary code.

The attack requires network access and the attacker must have sufficient privileges to create or modify pull requests targeting the develop to master merge path. While user interaction is required (the PR must be merged), the scope extends beyond the vulnerable component as the attacker gains control over the Actions runner environment.

Root Cause

The root cause is the direct use of untrusted user input (github.event.pull_request.body) in a shell execution context without proper sanitization or escaping. GitHub Actions expressions are evaluated before the shell receives the command, making traditional shell escaping ineffective. The secure approach is to pass such values through environment variables, which are properly escaped by the Actions runtime.

Attack Vector

The attack is network-based and exploits the GitHub Actions workflow execution model. An attacker crafts a pull request with a specially formatted body containing shell metacharacters and malicious commands. The payload might include command separators, subshell execution syntax, or other shell escape sequences.

When a repository maintainer merges the malicious PR from develop to master, the release.yml workflow triggers and the PR body is interpolated directly into the shell command. The attacker's payload executes with the permissions of the GitHub Actions runner, which typically has access to repository secrets, deployment credentials, and the ability to modify repository contents.

Exploitation could allow an attacker to exfiltrate secrets stored in the repository, inject malicious code into release artifacts, pivot to connected systems, or establish persistence within the CI/CD pipeline. For technical details on the vulnerable code pattern and the fix, refer to the GitHub Security Advisory GHSA-4q9f-mjxf-rx7x.

Detection Methods for CVE-2026-27938

Indicators of Compromise

• Unusual or unexpected commands appearing in GitHub Actions workflow logs
• Pull requests with suspicious body content containing shell metacharacters (;, |, $(), backticks)
• Unexpected network connections or data exfiltration from Actions runners
• Modifications to release artifacts or workflow files not matching expected changes

Detection Strategies

• Review GitHub Actions audit logs for workflow runs triggered by merged PRs with anomalous execution patterns
• Implement static analysis scanning on workflow files to detect unsafe expression usage in run: blocks
• Monitor for new or modified GitHub Actions workflows that introduce direct context expression usage
• Deploy SentinelOne Singularity to monitor CI/CD runner environments for unexpected process execution

Monitoring Recommendations

• Enable GitHub's security alerts and Dependabot to track WPGraphQL version updates
• Implement branch protection rules requiring code review for workflow file changes
• Configure alerts for Actions workflow failures or unusual execution times that may indicate exploitation attempts

How to Mitigate CVE-2026-27938

Immediate Actions Required

• Update WPGraphQL to version 2.9.1 or later immediately
• Audit all GitHub Actions workflows in your repositories for similar unsafe expression patterns
• Review recent PR merge history for any suspicious pull request bodies
• Rotate any secrets that may have been exposed through the Actions runner environment

Patch Information

The vulnerability is fixed in WPGraphQL version 2.9.1. The patch modifies the release.yml workflow to avoid direct interpolation of user-controlled input into shell commands. The fix can be reviewed in the GitHub commit de0c2d590593f1099546ad517106e454a498bc58. Organizations should update to the patched version and verify the workflow file matches the secure implementation.

Workarounds

• Temporarily disable the vulnerable release.yml workflow until the update can be applied
• Implement strict branch protection requiring additional review for PRs targeting the develop to master merge path
• Use environment variables instead of direct expression interpolation when handling PR metadata in workflows
• Restrict repository write access to limit who can create pull requests

# Secure pattern for GitHub Actions - use environment variables
# Instead of: echo "${{ github.event.pull_request.body }}"
# Use the following pattern in your workflow:

env:
  PR_BODY: ${{ github.event.pull_request.body }}
run: |
  echo "$PR_BODY"