Skip to content

Conversation

@kiblik
Copy link
Contributor

@kiblik kiblik commented Dec 12, 2025

Avoid issue from #13856 + #13878

@kiblik kiblik marked this pull request as ready for review December 13, 2025 13:29
@dryrunsecurity
Copy link

DryRun Security

This pull request introduces a command injection risk in the GitHub Actions workflow (.github/workflows/test-helm-chart.yml): the PR title (user-controlled) is embedded in a single-quoted shell string for a yq command without proper handling of single quotes, and the sanitization explicitly excludes single-quote escaping, allowing an attacker to terminate the string and inject arbitrary shell commands.

Command Injection in .github/workflows/test-helm-chart.yml
Vulnerability Command Injection
Description The GitHub Actions workflow uses the pull request title, which is user-controlled, in a shell command without properly sanitizing single quotes. The title variable is used within a single-quoted string in the yq command. If the pull request title contains a single quote, it can prematurely terminate the single-quoted string, allowing an attacker to inject arbitrary shell commands. The existing sanitization loop explicitly excludes the single quote character, making this vulnerability exploitable.

yq -i '.annotations."artifacthub.io/changes" += "- kind: changed\n description: '$title'\n"' helm/defectdojo/Chart.yaml
git add helm/defectdojo/Chart.yaml
git commit -m "ci: update Chart annotations from PR #${{ github.event.pull_request.number }}" || echo "No changes to commit"


All finding details can be found in the DryRun Security Dashboard.

@valentijnscholten valentijnscholten added this to the 2.53.2 milestone Dec 13, 2025
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch requested a review from blakeaowens December 15, 2025 06:28
@Maffooch Maffooch merged commit 01b2a16 into DefectDojo:bugfix Dec 15, 2025
148 of 149 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants