CVE-2026-54344: ToolJet CI/CD RCE Vulnerability

CVE-2026-54344 Overview

CVE-2026-54344 is a command injection vulnerability in ToolJet, an open-source low-code platform for building internal tools. The flaw exists in the render preview deployment workflow, which interpolates github.event.comment.body directly into a bash conditional inside a run step. Any GitHub user who can comment on an open pull request with a deploy command can execute arbitrary shell commands on the CI runner. Attackers exploiting this weakness can exfiltrate deployment secrets stored in the CI environment. The issue is reported as fixed in ToolJet version 3.20.180.

Critical Impact
Untrusted comment input flows into a shell context, allowing execution of arbitrary commands on the GitHub Actions runner and theft of deployment secrets.

Affected Products

ToolJet versions prior to 3.20.180
GitHub Actions workflow render preview deployment
CI/CD pipelines relying on the affected ToolJet workflow

Discovery Timeline

2026-07-08 - CVE-2026-54344 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54344

Vulnerability Analysis

The weakness maps to [CWE-78] Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). ToolJet's GitHub Actions workflow reads the pull request comment body and embeds the raw string into a bash conditional executed by the runner. Because GitHub Actions expression interpolation happens before shell parsing, the comment text becomes part of the shell script itself. A commenter can close the conditional and append additional shell commands to run on the CI runner. Those commands execute with the workflow's permissions and can access secrets exposed to the job, including deployment credentials.

Root Cause

The root cause is direct interpolation of untrusted user input, github.event.comment.body, into a run step. GitHub Actions expression syntax substitutes the value into the script text before execution, bypassing any shell quoting. The workflow does not pass the comment through an environment variable or validated input, and does not restrict which users may trigger the deploy path.

Attack Vector

An attacker with permission to comment on an open pull request writes a deploy command containing shell metacharacters. When the workflow triggers, the injected payload runs on the GitHub-hosted runner. The attacker can read environment variables, exfiltrate secrets via outbound HTTP requests, or tamper with the preview deployment. Exploitation requires only the ability to post a comment on an open pull request, which is typically available to any authenticated GitHub user on public repositories. See the GitHub Security Advisory for the specific workflow file and payload structure.

Detection Methods for CVE-2026-54344

Indicators of Compromise

Unexpected outbound network connections originating from GitHub Actions runners executing the render preview workflow
Pull request comments containing shell metacharacters such as backticks, $(...), ;, &&, or | alongside deploy keywords
Workflow logs showing shell commands not defined in the repository's workflow files
Rotation events or anomalous use of deployment secrets shortly after PR comment activity

Detection Strategies

Audit GitHub Actions workflow run logs for the render preview deployment job and inspect the rendered run script for injected content
Review pull request comment history for deploy commands containing suspicious characters or command chaining
Correlate secret usage in downstream deployment services with the GitHub identities that triggered workflow runs

Monitoring Recommendations

Enable GitHub audit log streaming and forward workflow run events to a SIEM for query and retention
Alert on workflow executions triggered by issue_comment events on external contributor pull requests
Monitor for secret access from unusual source IPs associated with GitHub-hosted runners

How to Mitigate CVE-2026-54344

Immediate Actions Required

Upgrade ToolJet to version 3.20.180 or later, which contains the fixed workflow
Rotate any deployment secrets referenced by the affected workflow, including Render API tokens and cloud provider credentials
Review workflow run history for suspicious issue_comment triggers prior to patching

Patch Information

ToolJet fixed the vulnerability in version 3.20.180. The fix removes direct interpolation of github.event.comment.body into shell context. Full remediation details are available in the GitHub Security Advisory GHSA-4pm2-w6g5-28mm.

Workarounds

Restrict the workflow trigger so only repository collaborators can invoke the deploy path via comment
Pass comment content through an environment variable and validate it against an allowlist regex before use
Scope job-level permissions to the minimum required and avoid exposing deployment secrets to comment-triggered jobs

bash

# Configuration example: safer handling of comment input in a workflow step
- name: Check deploy command
  env:
    COMMENT_BODY: ${{ github.event.comment.body }}
  run: |
    if [[ "$COMMENT_BODY" =~ ^/deploy[[:space:]]preview$ ]]; then
      echo "deploy=true" >> "$GITHUB_OUTPUT"
    fi