3 ms·

>I’m still a bit unclear how that could happen in practice thought. So the PR/Issue text would need to be written to stdout? Yes. The issue title (the two acti

>I’m still a bit unclear how that could happen in practice thought. So the PR/Issue text would need to be written to stdout? Yes. The issue title (the two actions the P0 issue talks about both do this) or the text, and same for PRs.

mjgs 6y ago
Right so that enables a potential hacker to set an env variable, which has to in a later step get picked up by another cli tool that uses the env variable in such a way that the contents of the env variable gets executed as code. So interpreters like node/ruby/perl etc could execute the malicious stuff in the env variables. Are there any other cli tools that could do something dangerous?