Executive Summary

The vulnerability exists in the Super-linter GitHub Action versions from 6.0.0 to 8.3.0. It allows command injection through crafted filenames that contain shell command substitution syntax, such as $(...). When these specially crafted filenames are processed during file discovery, the embedded commands can be executed in the workflow runner context.

This happens because the runtime scripts in the affected versions do not properly sanitize filenames, leading to arbitrary command execution.

An attacker can exploit this by submitting a pull request with a malicious filename, causing commands to run when the Super-linter action processes the files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary command execution within the GitHub Actions workflow runner environment.

An attacker exploiting this can potentially disclose sensitive information such as the job’s GITHUB_TOKEN, depending on the workflow's permission configuration.

This can result in unauthorized access, data leakage, or further compromise of the CI/CD pipeline and associated resources.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Super-linter GitHub Action to version 8.3.1 or later, where the issue is fixed.

Avoid using vulnerable versions (6.0.0 to 8.3.0) in your workflows to prevent command injection via crafted filenames.

Useful 0 Not Useful 0