CVE-2026-58502 json
githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
published 2026-06-19 4 mo ago modified 2026-09-30 39 d ago also EUVD-2026-78911 , GHSA-c3xh-98xp-6qhf
- cvss
- 7.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can therefore execute commands on the GitHub Actions runner before the title is included in the Discord notification sent through DISCORD_WEBHOOK. Successful exploitation can manipulate or spoof trusted bot notifications and may expose the Discord webhook secret or other workflow environment data, depending on repository permissions. This issue is fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.
Patch / fix
- github-actions gouef/githubtoplanguages 1.1.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 52 d ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/gouef/githubtoplanguages/security/advisories/GHSA-c3xh-98xp-6qhf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| github-actions | gouef/githubtoplanguages | <1.1.4 |
1.1.4 |
Affected products
- gouef githubtoplanguages
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- github.com /gouef/githubtoplanguages/commit/6bf9c3a9cb66c937b9047ca266b3d02f2bb11027
-
github.com
/gouef/githubtoplanguages/commit/157840482e592bd4f8e0617539e73cdbef26f1ac
web
-
github.com
/gouef/githubtoplanguages/security/advisories/GHSA-c3xh-98xp-6qhf
exploit, web
-
github.com
/gouef/githubtoplanguages
package
Sources
- CVE List CVE-2026-58502
- GitHub Advisory GHSA-c3xh-98xp-6qhf
- NVD CVE-2026-58502
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.