Coordinated Disclosure Timeline

• 2025-08-13: Vulnerability was reported via GitHub’s private vulnerability reporting feature.
• 2025-08-13: Workflow was fixed.

Summary

A code injection vulnerability was identified in the then latest changeset of vets-api’s GitHub Actions workflow (ready_for_review.yml), which could have allowed unauthorized code execution during workflow runs.

Project

vets-api

Tested Version

The latest changeset at the moment of review

Details

Code injection in GitHub Actions ready_for_review.yml (GHSL-2025-105)

The GitHub action at .github/workflows/ready_for_review.yml executes user input. Below is the code snippet containing the vulnerability:

    echo "pr_branch=${{ github.head_ref }}" >> $GITHUB_OUTPUT
    ...
    HEAD_BRANCH="${{ github.event.workflow_run.head_branch }}"
    ...
    echo "pr_branch=${{ github.event.workflow_run.head_branch }}" >> $GITHUB_OUTPUT

The user input ${{ github.head_ref }} and ${{ github.event.workflow_run.head_branch }} (the branch name) is directly evaluated in the run section, making it vulnerable to code injection.

Trigger and Permissions

The workflow is triggered by:

• pull_request (user controlled trigger)
• workflow_run (depends on workflows with user controlled triggers)

The dependent workflows for the workflow_run trigger are:

• .github/workflows/audit_service_tags.yml (triggered by pull_request)
• .github/workflows/check_codeowners.yml (triggered by pull_request)
• .github/workflows/code_checks.yml (triggered by pull_request)
• .github/workflows/codeql-analysis.yml (triggered by pull_request)

The vulnerable job grants permissions: write-all.

Impact

This issue may lead to code execution with high privileges.

Credit

This issue was discovered by CodeQL and an AI agent developed by the GitHub Security Lab and reported by GHSL team member @p- (Peter Stöckli).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2025-105 in any communication regarding this issue.