GitHub Actions workflow injection in Snowflake connector repo via crafted issues

Tue, 18 Aug 2026 11:37:25 +0000

Engineer — Plan: This is a textbook workflow injection pattern — untrusted input from issue metadata flowing into shell steps. Audit your own repos under .github/workflows/ for any workflow triggered by issue/PR events that interpolates github.event.issue.title or body into run: commands, and replace with intermediate env vars or safe contexts.
SOC/IR — Learn: No IOCs or active exploitation are reported, so there is nothing to hunt or detect today; however, understanding that crafted GitHub issues can trigger arbitrary commands in CI pipelines is useful context for evaluating future CI/CD-targeted campaigns.
Leader — Skip

Workflow-Injection on CuraSec