Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Wiz disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public `snowflakedb/snowflake-connector-net` repository that allowed crafted GitHub issues to trigger command injection The vulnerable workflow (`jira_issue.yml`) directly interpolated attacker-controlled issue title and body values into a shell `run:` block, exposing Jira credentials (API token, email, base URL) to potential exfiltration Wiz's Red Agent system successfully exploited the flaw during authorized securit
Analysis
TL;DR
- Wiz disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public
snowflakedb/snowflake-connector-netrepository that allowed crafted GitHub issues to trigger command injection - The vulnerable workflow (
jira_issue.yml) directly interpolated attacker-controlled issue title and body values into a shellrun:block, exposing Jira credentials (API token, email, base URL) to potential exfiltration - Wiz's Red Agent system successfully exploited the flaw during authorized security testing, obtaining a Jira API token with read access to engineering, security compliance, and bug bounty tracking projects
- Snowflake merged a fix within hours of disclosure (PR #1402 on June 23, 2026), replacing direct expression expansion with environment variables passed safely to
jq - Snowflake stated no evidence of unauthorized access was found during the five-day exposure window, and the Jira token was rotated on June 24, 2026
Why It Matters
This vulnerability exemplifies the growing class of GitHub Actions workflow injection flaws that arise when untrusted user-generated content (issue titles, bodies, comments) is directly interpolated into shell commands within CI/CD pipelines. For AI practitioners and DevOps teams, it underscores the critical importance of treating all external inputs in workflow files as potentially malicious, regardless of the repository's visibility or perceived trust level. The incident also highlights how AI coding assistants like GitHub Copilot can inadvertently introduce security vulnerabilities when their suggestions are merged without adequate security review.
Technical Details
- Vulnerable workflow:
.github/workflows/jira_issue.ymltriggered on public issue open events, directly embedding${{ github.event.issue.title }}and${{ github.event.issue.body }}into arun:shell block - Credential exposure: The workflow exposed
JIRA_BASE_URL,JIRA_USER_EMAIL, andJIRA_API_TOKENas environment variables accessible to the same step that processed untrusted issue data - Bypassed guardrail: The workflow checked
github.event.pull_request.user.loginagainstwhitesource-for-github-com[bot], but since the event was an issue (not a pull request), this property evaluated to an empty string per GitHub's documented behavior, failing to filter out ordinary issue submissions - Exploitation method: Wiz's Red Agent system initially encountered a shell syntax error, adapted its payload, and achieved out-of-band callback confirmation from the GitHub Actions runner, successfully extracting the Jira API token
- Fix: PR #1402 replaced direct GitHub expression expansion with environment variables passed as arguments to
jq, eliminating the injection vector; the fix has been present on themasterbranch since June 23, 2026
Industry Insight
- AI-assisted coding requires security validation: Snowflake attributed the flaw to a GitHub Copilot Autofix change, though commit history shows Copilot participated in the PR without directly authoring the vulnerable lines. This reinforces that AI-generated code suggestions must undergo the same security review as human-written code, especially in CI/CD contexts.
- Workflow injection is a systemic risk: GitHub documented this class of vulnerability as early as July 2025, yet it persisted for five days in a major cloud provider's repository. Organizations should adopt automated scanning for workflow injection patterns (e.g., direct interpolation of event data into
run:blocks) as part of their supply chain security posture. - No CVE assigned yet, but risk is real: As of August 2026, no CVE, CVSS score, or CISA KEV entry exists for this flaw, and no wild exploitation has been confirmed. However, the successful authorized exploitation and credential access demonstrate that similar patterns in other repositories may be actively exploitable. Teams should proactively audit their GitHub Actions workflows for the same vulnerability pattern.
Disclaimer: The above content is generated by AI and is for reference only.