Remote Code Execution in ToolJet CI/CD Pipeline

Compliance Impact

This vulnerability allows unauthenticated attackers to execute arbitrary shell commands on the CI runner and exfiltrate sensitive deployment secrets such as API keys and tokens.

The exfiltration of sensitive secrets could lead to unauthorized access to protected data or systems, potentially resulting in violations of data protection regulations like GDPR or HIPAA if such secrets are used to access personal or health-related data.

Therefore, this vulnerability poses a risk to compliance with common standards and regulations by enabling unauthorized disclosure of sensitive information.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54344 is a vulnerability in ToolJet's GitHub Actions workflow that allows an attacker to execute arbitrary shell commands on the continuous integration (CI) runner.

The issue arises because the workflow directly inserts the content of GitHub issue comments into a bash conditional statement without proper sanitization. This means any GitHub user who can comment on an open pull request can craft a malicious comment that breaks out of the intended command context and runs arbitrary commands.

This vulnerability enables attackers to exfiltrate sensitive deployment secrets such as API keys and tokens from the CI environment.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized execution of commands on the CI runner, which can compromise the security of your deployment pipeline.

Attackers can steal sensitive secrets like API keys, GitHub tokens, and SMTP credentials, potentially leading to further unauthorized access, data breaches, or disruption of services.

Since the vulnerability allows any GitHub user to trigger the exploit by commenting on an open pull request, it poses a significant risk even from unauthenticated or low-privilege users.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the GitHub Actions workflows, specifically the `render-preview-deploy.yml` file, for unsafe interpolation of user-controlled input such as `${{ github.event.comment.body }}` directly into bash commands without sanitization.

To detect exploitation attempts on your system, you can monitor CI runner logs for unusual shell command executions triggered by pull request comments containing `/deploy-ee` or other suspicious payloads.

Example commands to check for suspicious activity might include:

• Searching GitHub Actions workflow files for unsafe interpolation: `grep -r '\${{ github.event.comment.body }}' .github/workflows/`
• Checking CI runner logs for commands triggered by comments: `grep '/deploy-ee' /path/to/ci/runner/logs`
• Monitoring for shell command injections by reviewing recent CI job logs for unexpected shell commands or secret exfiltration attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating ToolJet to version 3.20.180 or later, where this vulnerability is fixed.

If updating is not immediately possible, modify the GitHub Actions workflow to add author association checks that restrict which users can trigger the deploy command via comments.

Avoid directly interpolating user-controlled input such as `${{ github.event.comment.body }}` into shell commands. Instead, use intermediate environment variables with proper sanitization.

Additionally, review and rotate any potentially exposed secrets such as `RENDER_API_KEY`, `CUSTOM_GITHUB_TOKEN`, and SMTP credentials to prevent unauthorized access.

Useful 0 Not Useful 0