CVE-2026-58502
Received Received - Intake

Command Injection in GitHubTopLanguages Workflow

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-58502
EUVD
EUVD-2026-78911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
github githubtoplanguages to 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a GitHub Actions workflow in githubtoplanguages that improperly handles user-provided issue titles. The workflow directly interpolates the issue title into a Bash variable assignment without proper sanitization. If the title contains shell command-substitution syntax, it can execute arbitrary commands on the GitHub Actions runner before sending a Discord notification. The issue was fixed in commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.

Detection Guidance

This vulnerability is specific to GitHub Actions workflows and cannot be detected with standard network or system commands. Check the .github/workflows/discord-issue.yml file in the githubtoplanguages repository for the vulnerable pattern where github.event.issue.title is interpolated directly into a Bash assignment without proper sanitization.

Impact Analysis

An attacker could exploit this to run malicious commands on the GitHub Actions runner, potentially stealing secrets like the Discord webhook URL or other workflow environment data. This could allow manipulation or spoofing of trusted bot notifications, leading to misinformation or unauthorized access to sensitive information.

Mitigation Strategies

Update the repository to include commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027 or later. Ensure all GitHub Actions workflows properly sanitize user-provided input before using it in shell commands or environment variables.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart