Skip to content
Fencer Vulns
high 8.1

CVE-2023-34111 json

Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin

published 2023-06-06 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-38213

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.0%
EPSS 4.0% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of `${{ github.event.pull_request.title }}` in a bash command within the GitHub workflow. Attackers can inject malicious commands which will be executed by the workflow. This happens because `${{ github.event.pull_request.title }}` is directly passed to bash command on like 25 of the workflow. This may allow an attacker to gain access to secrets which the github action has access to or to otherwise make use of the compute resources.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

4.05% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/taosdata/grafanaplugin/security/advisories/GHSA-23wp-p848-hcgr referenced PoC, tagged "exploit" by a source, unverified
  • securitylab.github.com https://securitylab.github.com/research/github-actions-untrusted-input/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • taosdata grafanaplugin

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.