CVE-2026-58502: githubtoplanguages Workflow RCE Vulnerability

CVE-2026-58502 Overview

CVE-2026-58502 is a command injection vulnerability in githubtoplanguages, a project that generates a user's top GitHub languages as an SVG. The flaw resides in the .github/workflows/discord-issue.yml GitHub Actions workflow, which runs when an issue is opened or closed. The workflow interpolates github.event.issue.title directly into a Bash assignment for ISSUE_TITLE before shell parsing. An attacker who can open or close an issue can supply a title containing shell command-substitution syntax to execute arbitrary commands on the GitHub Actions runner. The issue is tracked as [CWE-78] and is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.

Critical Impact
Successful exploitation runs attacker-controlled commands on the Actions runner, can leak the DISCORD_WEBHOOK secret, and enables spoofing of trusted bot notifications in Discord.

Affected Products

gouef/githubtoplanguages repository workflow .github/workflows/discord-issue.yml
Repository forks retaining the vulnerable workflow prior to commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027
Any downstream project reusing the vulnerable workflow pattern

Discovery Timeline

2026-09-15 - CVE-2026-58502 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-58502

Vulnerability Analysis

The vulnerability is a classic GitHub Actions script injection. The workflow triggers on issues events and constructs a shell command that embeds untrusted issue metadata directly into the script body. Because GitHub Actions performs template expansion of ${{ github.event.issue.title }} before the shell interprets the resulting script, any special characters in the title become part of the executed command line. Command-substitution syntax such as $(...) or backticks is evaluated by Bash inside the assignment to ISSUE_TITLE, giving the attacker arbitrary command execution on the runner. Because the runner also holds DISCORD_WEBHOOK in its environment, exfiltration and message spoofing are both feasible.

Root Cause

The root cause is unsafe interpolation of untrusted input into shell context, mapped to [CWE-78] (OS Command Injection). GitHub Actions expression syntax substitutes text before shell parsing, so any control characters in github.event.issue.title are interpreted as shell syntax rather than data. The workflow did not pass the value through an intermediate environment variable or quote it defensively before use.

Attack Vector

An authenticated GitHub user with permission to open or close issues on the repository crafts an issue title containing shell command-substitution syntax. When the workflow runs, Bash evaluates the embedded expression during the ISSUE_TITLE assignment. The commands run with the privileges and secrets available to the workflow job, including access to DISCORD_WEBHOOK and repository tokens. The attacker can then post spoofed notifications, exfiltrate secrets, or pivot to modify workflow artifacts.

No synthetic exploitation code is provided. Refer to the GitHub Security Advisory GHSA-c3xh-98xp-6qhf for the vendor's technical write-up.

Detection Methods for CVE-2026-58502

Indicators of Compromise

Unexpected outbound network connections from GitHub Actions runners during issues events
Discord webhook messages that do not correspond to legitimate issue activity or that contain unusual formatting
Recent issues with titles containing $(...), backticks, or shell metacharacters
Workflow run logs showing shell errors or unexpected command output during the ISSUE_TITLE assignment step

Detection Strategies

Audit .github/workflows/*.yml for direct interpolation of github.event.* fields inside run: blocks
Enable GitHub Advanced Security code scanning with CodeQL Actions queries that flag script injection in workflows
Review workflow run history for jobs triggered by issue events with anomalous durations or non-zero exit codes

Monitoring Recommendations

Forward GitHub audit logs and Actions workflow logs to a centralized analytics platform for correlation with secret access events
Alert on rotations or reuse of DISCORD_WEBHOOK and other workflow secrets outside expected patterns
Track newly created issues with titles matching regex patterns for shell metacharacters and command substitution

How to Mitigate CVE-2026-58502

Immediate Actions Required

Update the workflow to the fixed version by applying commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027
Rotate the DISCORD_WEBHOOK secret and any other secrets exposed to the vulnerable workflow
Review issue history for titles containing shell metacharacters and inspect corresponding workflow runs
Restrict who can open or close issues on repositories that use this workflow until patched

Patch Information

The maintainer resolved the flaw in commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027. Full advisory details are published as GHSA-c3xh-98xp-6qhf.

Workarounds

Pass untrusted event context through an intermediate env: variable and reference it in shell with quoted "$VAR" syntax
Remove the issues trigger from the workflow until the patched version is deployed
Use actions/github-script with parameterized inputs instead of Bash interpolation
Apply the principle of least privilege by setting permissions: explicitly and scoping secrets to specific jobs

bash

# Safe pattern for handling untrusted issue titles in GitHub Actions
jobs:
  notify:
    runs-on: ubuntu-latest
    permissions:
      issues: read
    steps:
      - name: Send Discord notification
        env:
          ISSUE_TITLE: ${{ github.event.issue.title }}
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        run: |
          # Quote the variable so Bash treats it as data, not code
          curl -H "Content-Type: application/json" \
               -d "{\"content\": \"New issue: ${ISSUE_TITLE}\"}" \
               "${DISCORD_WEBHOOK}"