CVE-2026-39866: Lawnchair Command Injection RCE Vulnerability

CVE-2026-39866 Overview

CVE-2026-39866 is a command injection vulnerability affecting Lawnchair, a free, open-source home app for Android. The vulnerability exists in the release_update.yml GitHub Actions workflow dispatch input, allowing attackers with repository access to inject arbitrary commands that execute within the CI/CD pipeline context.

Critical Impact

This command injection vulnerability enables arbitrary code execution within the GitHub Actions runner environment, potentially allowing attackers to compromise the build pipeline, steal secrets, or inject malicious code into release artifacts.

Affected Products

• Lawnchair (all versions prior to commit fcba413f55dd47f8a3921445252849126c6266b2)

Discovery Timeline

• April 21, 2026 - CVE-2026-39866 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-39866

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection), a critical class of security flaws where user-controlled input is incorporated into system commands without proper sanitization. In the context of GitHub Actions workflows, workflow dispatch inputs that are directly interpolated into shell commands can be exploited by authenticated users who can trigger the workflow.

The vulnerable workflow release_update.yml accepts user input through the workflow dispatch mechanism. When this input is used directly in shell commands within the workflow steps without proper escaping or validation, an attacker can craft malicious input containing shell metacharacters or command separators to execute arbitrary commands on the GitHub Actions runner.

Root Cause

The root cause lies in the improper handling of workflow dispatch inputs within the GitHub Actions workflow file. The workflow accepts external input and passes it directly to shell commands without sanitization, allowing command injection. GitHub Actions workflows that use ${{ inputs.* }} or ${{ github.event.inputs.* }} syntax directly in run: blocks are susceptible to this type of injection when the input is not properly quoted or validated.

Attack Vector

The attack requires network access and low privileges (authenticated repository access with workflow trigger permissions). An attacker with the ability to manually trigger the workflow can supply specially crafted input containing shell command injection payloads. These payloads break out of the intended command context and execute arbitrary commands within the GitHub Actions runner environment.

The attacker could potentially:

• Exfiltrate repository secrets and environment variables
• Modify build artifacts before release
• Pivot to other systems accessible from the runner
• Persist access through modified workflow files

This vulnerability is exploited through malicious workflow dispatch input. For detailed technical analysis and the specific code changes, see the GitHub Security Advisory GHSA-9prc-pp2c-3427 and the patch commit.

Detection Methods for CVE-2026-39866

Indicators of Compromise

• Unexpected or unauthorized workflow dispatch events in GitHub Actions logs
• Unusual commands or network connections observed in workflow run logs
• Modified workflow files or unexpected commits to the repository
• Anomalous secrets access patterns or secret exfiltration attempts

Detection Strategies

• Monitor GitHub audit logs for workflow dispatch events from unexpected users or at unusual times
• Implement branch protection rules and require approval for workflow runs from external contributors
• Review workflow run logs for suspicious command patterns or unexpected output
• Enable GitHub's secret scanning and push protection features

Monitoring Recommendations

• Configure alerts for manual workflow dispatches on sensitive repositories
• Implement log aggregation for GitHub Actions workflow runs
• Establish baseline behavior for CI/CD pipelines and alert on deviations
• Use GitHub's repository security features to monitor for exposed secrets

How to Mitigate CVE-2026-39866

Immediate Actions Required

• Update Lawnchair to commit fcba413f55dd47f8a3921445252849126c6266b2 or later immediately
• Audit GitHub Actions workflow run history for any suspicious activity
• Rotate any secrets that may have been exposed through the CI/CD pipeline
• Review repository access permissions and remove unnecessary collaborators

Patch Information

The vulnerability is patched in commit fcba413f55dd47f8a3921445252849126c6266b2. Organizations using Lawnchair should update to this commit or any subsequent version that includes this fix. The patch can be reviewed at the GitHub Commit Details.

For additional context on the vulnerability and patch, refer to the GitHub Security Advisory GHSA-9prc-pp2c-3427.

Workarounds

• Restrict workflow dispatch permissions to trusted maintainers only
• Disable the vulnerable workflow until the patch can be applied
• Implement input validation at the workflow level using conditional checks before processing
• Use GitHub's environment protection rules to require manual approval for sensitive workflows

# Example: Restrict workflow dispatch to specific actors
# Add the following to your workflow file as a temporary mitigation
# This checks if the actor is in an allowed list before proceeding

if: contains('["trusted-user-1","trusted-user-2"]', github.actor)