Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow
Date: 2026-03
Affected: actions/SHAdd0WTAka/Zen-Ai-Pentest
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-78
CVSS: 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

## Summary The `ZenClaw Discord Integration` GitHub Actions workflow is vulnerable to shell command injection. The issue title field, controllable by any GitHub user, is interpolated directly into a `run` shell block via a GitHub Actions template expression. An attacker can craft an issue title containing a subshell expression that executes arbitrary commands on the runner during variable assignment, enabling exfiltration of the `DISCORD_WEBHOOK_URL` secret. The trigger requires no repository privileges. ## Affected Component **File:** `.github/workflows/zenclaw-discord.yml` **Commit:** `07e65c72656a8213fc9ece2b3f4fc719032cfc5d` **URL:** `https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/blob/07e65c72656a8213fc9ece2b3f4fc719032cfc5d/.github/workflows/zenclaw-discord.yml` **Step:** `Prepare Notification` **Trigger:** `issues: [opened]` — no repository privileges required --- ## Description In the `Prepare Notification` step, the issue title is assigned to a shell variable using direct GitHub Actions template interpolation inside a `case` block: ```bash issues) ... DESCRIPTION="${{ github.event.issue.title }}" ;; ``` The GitHub Actions template engine resolves `${{ github.event.issue.title }}` **at workflow compilation time**, embedding the raw issue title as literal text in the bash script before execution. The value is assigned inside a double-quoted string, which in bash evaluates subshell expressions of the form `$(...)` and backtick expressions `` `...` `


Mitigations:

Architectural layers (MAESTRO):