Injection

These can be set by anyone who can open an issue, PR, or comment:

A branch named $(<attacker-command>) or an issue titled "; <attacker-command> # becomes shell when interpolated into a run: step.

The Vulnerable Pattern

The Safe Pattern — Pass Through env:

Bind the untrusted value to an environment variable, then reference the shell variable (quoted). The shell variable is data, never re-parsed as workflow syntax:

${{ }} now appears only on the env: side, where it is assigned as a value rather than spliced into a command. Always quote the shell variable ("$PR_TITLE") to prevent word-splitting and globbing.

actions/github-script

The same rule applies. Do not interpolate ${{ }} into the script: body — pass it through the environment and read process.env:

Custom Action Inputs

Passing untrusted ${{ }} into a composite or JS action’s with: inputs can be safe or not depending on whether the action itself interpolates the input into a shell. When in doubt, pass via env: and have the action read the environment, or sanitize/validate first (e.g. a branch name should match ^[A-Za-z0-9._/-]+$).

Quick Audit Checklist

1. Grep every run: and script: for ${{.
2. For each, resolve what the expression points to.
3. If it can be set by a non-collaborator → rewrite via env: with a quoted shell variable.
4. github.actor, github.repository, github.sha, github.ref (for branch protection contexts) and similar server-controlled values are not attacker-set, but a defense-in-depth env: rewrite costs nothing.