CVE-2026-39382
Command Injection via Unescaped Comment in dbt GitHub Workflow
Publication date: 2026-04-07
Last updated on: 2026-04-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dbt-labs | dbt | * |
| peter-evans | find-comment | to bbed8d28354e9c644c5a7df13946a3a0451f9ab9 (inc) |
| dbt-labs | dbt-core | to bbed8d28354e9c644c5a7df13946a3a0451f9ab9 (inc) |
| peter-evans | find-comment | * |
| github | actions | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by analyzing the GitHub Actions workflow file `dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml` for unsafe handling of the output `steps.issue_comment.outputs.comment-body` from the peter-evans/find-comment action.
Specifically, detection involves checking if the workflow interpolates the `comment-body` output directly into a bash if statement without proper escaping or sanitization, which allows command injection.
To verify the presence of the vulnerability, you can review the workflow script for lines similar to:
- if [ '${{ steps.issue_comment.outputs.comment-body }}' = ' ' ] ; then ...
For practical detection on your system, you can use tools like Gato-X, a scanning and attack tool for GitHub Actions pipelines, or simulate the workflow locally using the `act` tool to test for command injection.
No specific network commands are provided, but reviewing the workflow file and testing with these tools can help detect the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the direct interpolation of untrusted inputs, such as `comment-body`, into shell scripts without proper escaping.
Instead, use environment variables and robust quoting to safely handle untrusted values. For example:
- Assign the comment body to a safe environment variable: `COMMENT_BODY="$SAFE_VALUE"`
- Use conditional checks like `[ -z "$COMMENT_BODY" ]` instead of string comparisons.
Apply the patch provided in commit `bbed8d28354e9c644c5a7df13946a3a0451f9ab9` which refactors the workflow to use environment variables and safer shell scripting practices.
Additionally, avoid placing attacker-controlled values inside `run:` shell scripts and review your GitHub Actions workflows for similar unsafe patterns.
Can you explain this vulnerability to me?
CVE-2026-39382 is a critical command injection vulnerability in a reusable GitHub Actions workflow used by dbt-labs. The vulnerability occurs because the workflow directly inserts the output of a comment search (steps.issue_comment.outputs.comment-body), which is attacker-controlled text, into a bash if statement without any escaping or sanitization.
Since the comment body is untrusted and inserted into shell syntax unsafely, an attacker can craft a malicious comment that breaks out of the quoted string and injects arbitrary shell commands. This allows execution of arbitrary commands within the CI environment.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including:
- Attackers can execute arbitrary shell commands in the CI environment.
- Secrets such as personal access tokens (e.g., FISHTOWN_BOT_PAT) can be exfiltrated.
- With stolen tokens, attackers can perform authenticated actions across repositories accessible to the bot, escalating the attack beyond a single runner.
- Injected commands can disrupt the CI pipeline by failing jobs, hanging runners, or consuming excessive resources.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-39382 is a critical command injection vulnerability in a GitHub Actions workflow that allows attackers to execute arbitrary shell commands in the CI environment.
This can lead to exfiltration of secrets such as personal access tokens, enabling attackers to perform authenticated actions across repositories accessible to the bot.
Such unauthorized access and potential data exposure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and controlled access.
Specifically, the compromise of secrets and unauthorized command execution could lead to breaches of confidentiality, integrity, and availability of data, which are core concerns of these regulations.