Claude 4d8da13da9 Fix command injection vulnerability in test-failure-analysis.yml ...

Prevent command injection by passing untrusted GitHub context values
(workflow_run.name and workflow_run.head_branch) through environment
variables instead of direct shell interpolation.

The vulnerability allowed malicious branch names with shell metacharacters
like $() to execute arbitrary commands. Now these values are safely passed
as environment variables which prevents shell expansion.

Fixes: HIGH severity command injection vulnerability on lines 66-67, 92

2025-12-13 20:47:34 +00:00

4.4 KiB

Raw Blame History

View Raw