Plan
active
GitHub Actions workflow injection in Snowflake connector repo via crafted issues
- Engineer — Plan: This is a textbook workflow injection pattern — untrusted input from issue metadata flowing into shell steps. Audit your own repos under .github/workflows/ for any workflow triggered by issue/PR events that interpolates github.event.issue.title or body into run: commands, and replace with intermediate env vars or safe contexts.
- SOC/IR — Learn: No IOCs or active exploitation are reported, so there is nothing to hunt or detect today; however, understanding that crafted GitHub issues can trigger arbitrary commands in CI pipelines is useful context for evaluating future CI/CD-targeted campaigns.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.