2 ms·

Yeah the fact that the untrusted inputs can come from PRs and Issues is worrying. I totally had not considered that. I’m still a bit unclear how that could hap

• Arnavion 6y ago
  >I’m still a bit unclear how that could happen in practice thought. So the PR/Issue text would need to be written to stdout? Yes. The issue title (the two actions the P0 issue talks about both do this) or the text, and same for PRs.
  • mjgs 6y ago
    Right so that enables a potential hacker to set an env variable, which has to in a later step get picked up by another cli tool that uses the env variable in such a way that the contents of the env variable gets executed as code. So interpreters like node/ruby/perl etc could execute the malicious stuff in the env variables. Are there any other cli tools that could do something dangerous?