CVE-2026-67308CWE-78command-injection

CVE-2026-67308

published August 1, 2026

CVSS
9.3
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00729 · 53.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-01T17:17Z
References (3)
https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh · [email protected]https://www.vulncheck.com/advisories/wazuh-github-actions-shell-injection-via-fork-pull-request · [email protected]https://github.com/wazuh/wazuh/security/advisories/GHSA-95w2-gpvr-q4jh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    Wazuh GitHub Actions Shell Injection via Fork Pull Request
    cvelistv5