Are your GitHub Actions workflows vulnerable to command injection?

Are your GitHub Actions workflows vulnerable to command injection?

When writing custom GitHub Workflows, context data like issue titles, PR descriptions, branch names, and commit messages are often treated as safe string values. However, because these fields can be controlled by external users or contributors, they must be treated as untrusted input.

If untrusted expressions (e.g., ${{ github.event.issue.title }}) are used directly inside inline run scripts, an attacker can craft inputs to inject arbitrary shell commands—potentially exposing repository secrets or write tokens.
💡 Key Takeaway & Best Practice: Instead of directly interpolating context expressions into inline scripts, assign them to intermediate environment variables first:

❌ Vulnerable:
By storing the value in memory as an environment variable rather than evaluating it directly during script generation, you prevent command injection.
Automating security checks using tools like CodeQL in your CI/CD pipeline can also help flag these expression injection patterns early.