What is GHSA-9chj-cp8j-3c5f?

GHSA-9chj-cp8j-3c5f is a security advisory published by GitHub Security Advisories with Medium severity. Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that...

Which CVE IDs does GHSA-9chj-cp8j-3c5f cover?

GHSA-9chj-cp8j-3c5f covers the following CVE IDs: CVE-2026-67308. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9chj-cp8j-3c5f?

GHSA-9chj-cp8j-3c5f has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-9chj-cp8j-3c5fMediumCVSS 10.0

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-67308 →

📋 Description

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

🔗 References (4)

https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh
https://nvd.nist.gov/vuln/detail/CVE-2026-67308
https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request
https://github.com/advisories/GHSA-9chj-cp8j-3c5f