Read the docs
TI-2023-14439 Aliases CVE-2023-30623GHSA-rg3q-prf8-qxmp

Arbitrary command injection in embano1/wip

Priority MEDIUM 46CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03728 89th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed wip (embano1): 2embano1/wip (GitHub Actions): 2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
embano1wipbefore 22Patch availableCNA
—embano1/wip (GitHub Actions)before 22Patch availableGHSA-rg3q-prf8-qxmp
  • wip Vendorembano1 Affected before 2 Fixed in 2 Patch available CNA
  • embano1/wip (GitHub Actions) Vendor— Affected before 2 Fixed in 2 Patch available GHSA-rg3q-prf8-qxmp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wip_project:wip:*:*:*:*:*:*:*:*before 2.0.0VulnerableWip Project
  • cpe:2.3:a:wip_project:wip:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Wip Project

Remediation

  • Fix · CNA wip (embano1) Fixed in 2
  • Fix · GHSA-rg3q-prf8-qxmp embano1/wip (GitHub Actions) Fixed in 2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30623
  2. 2026-10-03 Alias added: GHSA-rg3q-prf8-qxmp

References

Exploit 1

Patch 1

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences